Function at 0x418020
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4628de
mov eax, dword fs:[0]
push eax
mov eax, 0x187c
call fcn.0044f450
mov eax, dword [0x47f038]
xor eax, esp
mov dword [esp + 0x1878], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47f038]
xor eax, esp
push eax
lea eax, [esp + 0x1890]
mov dword fs:[0], eax
mov edi, dword [esp + 0x18a0]
push edi
push str.ProcessSectionDelDirs_____s__n
mov ebp, ecx
mov dword [esp + 0x28], edi
call fcn.004412c0
mov ecx, dword [ebp + 4]
add esp, 8
xor esi, esi
push esi
lea eax, [esp + 0x890]
push eax
push esi
push edi
mov dword [esp + 0x2c], esi
call 0x409a30
test al, al
je 0x41872d
jmp 0x4180a0
lea ecx, [esp + 0x88c]
push ecx
push esi
push edi
push str.__s___d____s__n
call fcn.004412c0
mov edx, dword [ebp + 8]
add esp, 0x10
cmp byte [edx + 0x1e89], 0
je 0x4180cf
mov ecx, ebp
call fcn.00416fc0
jmp 0x41870c
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x27e]
push ecx
mov word [esp + 0x280], ax
call fcn.0044e1b0
xor bl, bl
push 0x1c2d0
mov byte [esp + 0x27], bl
call fcn.0044e29f
add esp, 0x10
mov dword [esp + 0x18], eax
xor esi, esi
mov dword [esp + 0x1898], esi
cmp eax, esi
je 0x418119
mov ecx, eax
call fcn.004409e0
mov esi, eax
push 0x46ce98
lea edx, [esp + 0x890]
push edx
mov ecx, esi
mov dword [esp + 0x18a0], 0xffffffff
call fcn.00440c30
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x41853c
cmp byte [esi + 0x1c2cc], 0
je 0x418169
cmp edi, dword [esi + 0x1c2c8]
jl 0x41815b
xor eax, eax
jmp 0x41817f
mov eax, edi
shl eax, 0xb
lea eax, [eax + esi + 0x32c8]
jmp 0x41817f
cmp edi, dword [esi + 0x1c2c8]
jl 0x418175
xor eax, eax
jmp 0x41817f
mov eax, edi
imul eax, eax, 0x104
add eax, esi
push eax
push edi
push str.___d____s__n
call fcn.004412c0
mov eax, edi
add esp, 0xc
sub eax, 0
je 0x4184ec
sub eax, 1
jne 0x418531
cmp byte [esi + 0x1c2cc], al
je 0x4181bf
cmp dword [esi + 0x1c2c8], 1
jg 0x4181b7
xor ecx, ecx
jmp 0x4181d2
lea ecx, [esi + 0x3ac8]
jmp 0x4181d2
cmp dword [esi + 0x1c2c8], 1
jg 0x4181cc
xor ecx, ecx
jmp 0x4181d2
lea ecx, [esi + 0x104]
lea edx, [esp + 0x684]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x4181e0
lea ecx, [esp + 0x684]
push str.REMOVE_AFTER_REBOOT
push ecx
call fcn.0044e882
add esp, 8
test eax, eax
jne 0x41820f
mov byte [esp + 0x17], 1
lea edx, [esp + 0x684]
push str.REMOVE_ALL
push edx
call fcn.0044e882
add esp, 8
test eax, eax
jne 0x418531
mov ecx, dword [ebp + 0xc]
push str._MainTarget_
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x418247
mov bl, 1
push str._MainLink_
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x418262
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_WIA_Scanner
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x41827d
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_KyoceraWIA_Scanner
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x418298
mov bl, 1
push str._UserAppData_knv
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x4182b3
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._UserAppData_kmnv
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x4182ce
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._UserAppData__npm
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x4182e9
mov bl, 1
push str._UserAppData_Kyocera
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x418304
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._PublicDocuments_Kyocera
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x41831f
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_Kyocera
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x41833a
mov bl, 1
push str._AppData_KyoceraKMnet_Account_Agency_Server
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x418355
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_KyoceraKMnet_Account_Agency
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x418370
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_Policy_Manager
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x41838b
mov bl, 1
push str._UserAppData_Policy_Manager
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x4183a6
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_NetPolicyManager
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x4183c1
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._UserAppData_NetPolicyManager
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x4183dc
mov bl, 1
push str._AppData_Account_Agency_Server
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x4183f7
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_Account_Agency
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x418412
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Policy_Manager
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x41842d
mov bl, 1
push str._ProgramFiles_NetPolicyManager
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x418448
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Kyocera
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x418463
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_UTAX
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x41847e
mov bl, 1
push str._ProgramFiles_Olivetti
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x418499
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Chungho
lea edx, [esp + 0x278]
push edx
call fcn.004453e0
test eax, eax
je 0x4184b4
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Lenovo
lea eax, [esp + 0x278]
push eax
call fcn.004453e0
test eax, eax
je 0x4184cf
mov bl, 1
push str._ProgramFiles_ClientTool
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004453e0
test eax, eax
je 0x418531
mov bl, 1
jmp 0x418531
cmp byte [esi + 0x1c2cc], 0
je 0x41850a
cmp dword [esi + 0x1c2c8], 0
jg 0x418502
xor ecx, ecx
jmp 0x418518
lea ecx, [esi + 0x32c8]
jmp 0x418518
xor ecx, ecx
cmp dword [esi + 0x1c2c8], ecx
setle cl
dec ecx
and ecx, esi
lea edx, [esp + 0x274]
nop
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x418520
inc edi
cmp edi, dword [esp + 0x18]
jl 0x418146
mov ecx, dword [ebp + 0xc]
push 0x46742c
lea edx, [esp + 0x278]
push edx
call fcn.004451b0
lea eax, [esp + 0x274]
push eax
push 0xffffffffffffffff
push 0xf
mov ecx, ebp
call fcn.00416eb0
lea ecx, [esp + 0x274]
push ecx
mov ecx, ebp
call fcn.00417110
test bl, bl
je 0x4186ca
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x274]
push edx
call fcn.00448310
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x486]
push ecx
mov word [esp + 0x488], ax
call fcn.0044e1b0
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [esp + eax + 0x274]
mov word [esp + eax + 0x47c], cx
add eax, 2
test cx, cx
jne 0x4185b0
lea eax, [esp + 0x47c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4185d2
mov edx, dword [0x464ae8]
mov ecx, dword [0x464aec]
mov dword [eax], edx
mov dx, word [0x464af0]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x480]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
setne al
test eax, eax
je 0x4186c1
mov edx, 0x464ae4
lea ecx, [esp + 0x50]
mov si, word [ecx]
cmp si, word [edx]
jne 0x41864e
test si, si
je 0x41864a
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x41864e
add ecx, 4
add edx, 4
test si, si
jne 0x418628
xor ecx, ecx
jmp 0x418653
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x418663
lea edx, [esp + 0x24]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4186c1
mov edx, 0x464adc
lea ecx, [esp + 0x50]
mov si, word [ecx]
cmp si, word [edx]
jne 0x418696
test si, si
je 0x418692
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x418696
add ecx, 4
add edx, 4
test si, si
jne 0x418670
xor ecx, ecx
jmp 0x41869b
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x4186ab
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4186c1
push 1
push 0
push 0
push 0x8901
mov ecx, ebp
call fcn.00416f90
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4186f1
cmp byte [esp + 0x17], 0
je 0x4186e3
lea ecx, [esp + 0x274]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00445f30
jmp 0x4186f1
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x274]
push eax
push 0
push 0xf
mov ecx, ebp
call fcn.00416eb0
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x890]
push ecx
mov ecx, dword [ebp + 4]
inc esi
push esi
push edi
mov dword [esp + 0x2c], esi
call 0x409a30
test al, al
jne 0x4180a0
xor eax, eax
mov ecx, dword [esp + 0x1890]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1878]
xor ecx, esp
call fcn.0044e1a0
add esp, 0x1888
ret 4