Daniel Colascione writes:

> After another reading of cmdproxy.c, I also see that the
> CreateProcess path also doesn't expand environment %variable%
> references, and that doesn't fall back to cmd if the command
> to be executed contains them.  While we could expand these
> variables, doing so would move us even closer to
> reimplementing half of cmd.exe.

You are exaggerating a great deal.  It is a single function call,
ExpandEnvironmentStrings, documented at
http://msdn.microsoft.com/en-us/library/ms724265%28v=vs.85%29.aspx.
Patching cmdproxy.c to use ExpandEnvironmentStrings before calling
CreateProcess would add at most 10 lines of code.  This is by no means
"reimplementing half of cmd.exe."