Function at 0x140008c10
Capabilities:
Enumerate files on windows
Enumerate files recursively
Enumerate network shares

Disassembly:
sub rsp, 0x2d8
mov rax, qword [0x14000e398]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
xor edx, edx
mov dword [rsp + 0x68], 0xffffffff
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 0x4000
mov r9, rcx
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 2]
lea r8d, [rdx + 0x13]
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x140008f61
mov ecx, dword [rsp + 0x58]
mov qword [rsp + 0x2f8], rsi
call fcn.14000cad0
mov qword [rsp + 0x50], rax
mov rsi, rax
test rax, rax
je 0x140008f4f
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov r8, rax
lea rdx, [rsp + 0x68]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x140008f47
mov qword [rsp + 0x2e8], rbx
xor ebx, ebx
mov qword [rsp + 0x2f0], rbp
mov qword [rsp + 0x2d0], rdi
nop word [rax + rax]
cmp dword [rsp + 0x68], 0
mov edi, ebx
mov dword [rsp + 0x40], ebx
jbe 0x140008f10
mov eax, edi
lea rax, [rax + rax*2]
shl rax, 4
add rax, rsi
test byte [rax + 0xc], 2
je 0x140008cf1
mov rcx, rax
call fcn.140008c10
jmp 0x140008efb
mov rbp, qword [rax + 0x18]
lea rcx, [0x14000e420]
mov rdx, rbp
xor r8d, r8d
call fcn.14000cce0
test eax, eax
jne 0x140008d73
nop dword [rax + rax]
lea r8, [rsp + 0x6c]
xor edx, edx
lea rcx, [0x14000e3d0]
call fcn.14000cc30
mov rbx, rax
test rax, rax
je 0x140008d5b
nop dword [rax + rax]
mov rcx, rbx
call fcn.140007810
mov rcx, rbx
call fcn.14000cb00
lea r8, [rsp + 0x6c]
xor edx, edx
lea rcx, [0x14000e3d0]
call fcn.14000cc30
mov rbx, rax
test rax, rax
jne 0x140008d30
xor r8d, r8d
lea rcx, [0x14000e420]
mov rdx, rbp
call fcn.14000cce0
test eax, eax
je 0x140008d10
xor ebx, ebx
mov ecx, 0x10000
call fcn.14000cad0
mov rsi, rax
test rax, rax
je 0x140008ef6
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140003bd0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x140008e4f
mov rbx, rax
test byte [rsp + 0x70], 0x10
je 0x140008e2f
xor ebx, ebx
lea rdi, [0x14000e280]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140008e2a
inc ebx
add rdi, 8
cmp ebx, 0x22
jb 0x140008dd5
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140003bd8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x9c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rsi
call fcn.140009320
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140008dc5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140008eea
cmp dword [0x14000e470], 0
je 0x140008eee
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
mov r9d, eax
mov dword [rsp + 0x28], ebx
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.14000cad0
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbp
xor edx, edx
mov r9d, eax
mov ecx, 0xfde9
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rdi
lea rcx, [0x140003c40]
mov r8d, eax
call fcn.140005020
mov rcx, rdi
call fcn.14000cb00
mov edi, dword [rsp + 0x40]
mov rcx, rsi
call fcn.14000cb00
mov rsi, qword [rsp + 0x50]
inc edi
mov ebx, 0
mov dword [rsp + 0x40], edi
cmp edi, dword [rsp + 0x68]
jb 0x140008cd1
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov r8, rsi
lea rdx, [rsp + 0x68]
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
je 0x140008cc0
mov rdi, qword [rsp + 0x2d0]
mov rbp, qword [rsp + 0x2f0]
mov rbx, qword [rsp + 0x2e8]
mov rcx, rsi
call fcn.14000cb00
mov rcx, qword [rsp + 0x60]
call sub.MPR.dll_WNetCloseEnum
mov rsi, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14000ce70
add rsp, 0x2d8
ret