Pass NULL to lpApplicationName in CreateProcessA().
When NULL is given to lpApplicationName we enable Windows' "magical" path interpretation logic, which makes Tor 0.4.x behave in the same way as previous Tor versions did when it comes to executing binaries in different system paths. For more information about this have a look at the CreateProcessA() documentation on MSDN -- especially the string interpretation example is useful to understand this issue. This bug was introduced in commit bfb94dd2. See: https://bugs.torproject.org/29874