過去の回答はもっとスマートな方法かもしれませんが、、
#module
#uselib "kernel32"
#func OpenProcess		"OpenProcess" int, int, int
#func CloseHandle		"CloseHandle" int
#func ReadProcessMemory	"ReadProcessMemory" int, int, sptr, int, int
#uselib "ntdll"
#func NtQueryInformationProcess "NtQueryInformationProcess" int, int, sptr, int, sptr
#uselib "psapi"
#func EnumProcesses "EnumProcesses" sptr, int, sptr
#func EnumProcessModules "EnumProcessModules" int, sptr, int, sptr
#func GetModuleFileNameEx "GetModuleFileNameExA" int, int, sptr, int
#define PROCESS_QUERY_INFORMATION	0x400
#define PROCESS_VM_READ				0x10  
#defcfunc Get_CommandLine str prm
	dim lpidProcess, 0x400
	dim cb
	dim cbNeeded
	dim lphModule
	dim hProcess
	sdim lpFilename, 0x100
	dim ProcParamsAddress
	dim BlockAddress, 2
	dim _PROCESS_BASIC_INFORMATION, 6
	dim ReturnLength
	sdim CommandLineBuf
	
	EnumProcesses varptr(lpidProcess), 0x1000, varptr(cbNeeded)
	cb = cbNeeded
	dim lpidProcess, cb / 4
	EnumProcesses varptr(lpidProcess), cb, varptr(cbNeeded)
	repeat cb / 4
		OpenProcess PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, 0, lpidProcess(cnt)
		hProcess = stat
		if hProcess {
			EnumProcessModules hProcess, varptr(lphModule), 4, varptr(cbNeeded)
			if stat {
				GetModuleFileNameEx hProcess, lphModule, varptr(lpFilename), 0x100
				if getpath (lpFilename, 8) == prm {
					//PebBaseAddressの取得
					NtQueryInformationProcess hProcess, 0, varptr(_PROCESS_BASIC_INFORMATION), 0x18, varptr(ReturnLength)
					if stat = 0 {
						//ベースアドレスの取得
						ReadProcessMemory hProcess, _PROCESS_BASIC_INFORMATION(1) + 0x10, varptr(ProcParamsAddress), 4, 0
						//CommandLineデータ開始アドレスの取得
						ReadProcessMemory hProcess, ProcParamsAddress + 0x44, varptr(BlockAddress(0)), 4, 0
						//同上終端取得
						ReadProcessMemory hProcess, ProcParamsAddress + 0x74, varptr(BlockAddress(1)), 4, 0
						sdim CommandLineBlock, BlockAddress(1) - BlockAddress(0)
						ReadProcessMemory hProcess, BlockAddress(0), varptr(CommandLineBlock), BlockAddress(1) - BlockAddress(0), 0
						CommandLineBuf = cnvwtos (CommandLineBlock)
						CloseHandle hProcess
						break
					}
				}
			}
		}
		CloseHandle hProcess
	loop
return CommandLineBuf
#global
	exec "notepad /W"
	mes Get_CommandLine ("notepad.exe")
	mes Get_CommandLine ("hsp3.exe")
参考記事
http://www5.plala.or.jp/softworld/api_ReadProcessMemory.htm
http://webcache.googleusercontent.com/search?q=cache:jde8Gl7FOmYJ:wj32.org/wp/2009/01/24/howto-get-the-command-line-of-processes/
http://forum.sysinternals.com/cross-process-environment-vars_topic629.html
http://msdn.microsoft.com/ja-jp/library/windows/desktop/ms684280%28v=vs.85%29.aspx