Function at 0x416ff0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x45f36e
mov eax, dword fs:[0]
push eax
mov eax, 0x187c
call fcn.0044bf30
mov eax, dword [0x47b038]
xor eax, esp
mov dword [esp + 0x1878], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47b038]
xor eax, esp
push eax
lea eax, [esp + 0x1890]
mov dword fs:[0], eax
mov edi, dword [esp + 0x18a0]
push edi
push str.ProcessSectionDelDirs_____s__n
mov ebp, ecx
mov dword [esp + 0x28], edi
call fcn.0043e2c0
mov ecx, dword [ebp + 4]
add esp, 8
xor esi, esi
push esi
lea eax, [esp + 0x890]
push eax
push esi
push edi
mov dword [esp + 0x2c], esi
call fcn.004090a0
test al, al
je 0x4176fd
jmp 0x417070
lea ecx, [esp + 0x88c]
push ecx
push esi
push edi
push str.__s___d____s__n
call fcn.0043e2c0
mov edx, dword [ebp + 8]
add esp, 0x10
cmp byte [edx + 0x1e89], 0
je 0x41709f
mov ecx, ebp
call fcn.0040b1b0
jmp 0x4176dc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x27e]
push ecx
mov word [esp + 0x280], ax
call fcn.0044ac90
xor bl, bl
push 0x1c2d0
mov byte [esp + 0x27], bl
call fcn.0044ad7f
add esp, 0x10
mov dword [esp + 0x18], eax
xor esi, esi
mov dword [esp + 0x1898], esi
cmp eax, esi
je 0x4170e9
mov ecx, eax
call fcn.0043d9e0
mov esi, eax
push 0x469868
lea edx, [esp + 0x890]
push edx
mov ecx, esi
mov dword [esp + 0x18a0], 0xffffffff
call fcn.0043dc30
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x41750c
cmp byte [esi + 0x1c2cc], 0
je 0x417139
cmp edi, dword [esi + 0x1c2c8]
jl 0x41712b
xor eax, eax
jmp 0x41714f
mov eax, edi
shl eax, 0xb
lea eax, [eax + esi + 0x32c8]
jmp 0x41714f
cmp edi, dword [esi + 0x1c2c8]
jl 0x417145
xor eax, eax
jmp 0x41714f
mov eax, edi
imul eax, eax, 0x104
add eax, esi
push eax
push edi
push str.___d____s__n
call fcn.0043e2c0
mov eax, edi
add esp, 0xc
sub eax, 0
je 0x4174bc
sub eax, 1
jne 0x417501
cmp byte [esi + 0x1c2cc], al
je 0x41718f
cmp dword [esi + 0x1c2c8], 1
jg 0x417187
xor ecx, ecx
jmp 0x4171a2
lea ecx, [esi + 0x3ac8]
jmp 0x4171a2
cmp dword [esi + 0x1c2c8], 1
jg 0x41719c
xor ecx, ecx
jmp 0x4171a2
lea ecx, [esi + 0x104]
lea edx, [esp + 0x684]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x4171b0
lea ecx, [esp + 0x684]
push str.REMOVE_AFTER_REBOOT
push ecx
call fcn.0044b362
add esp, 8
test eax, eax
jne 0x4171df
mov byte [esp + 0x17], 1
lea edx, [esp + 0x684]
push str.REMOVE_ALL
push edx
call fcn.0044b362
add esp, 8
test eax, eax
jne 0x417501
mov ecx, dword [ebp + 0xc]
push str._MainTarget_
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x417217
mov bl, 1
push str._MainLink_
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x417232
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_WIA_Scanner
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x41724d
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_KyoceraWIA_Scanner
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x417268
mov bl, 1
push str._UserAppData_knv
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x417283
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._UserAppData_kmnv
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x41729e
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._UserAppData__npm
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x4172b9
mov bl, 1
push str._UserAppData_Kyocera
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x4172d4
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._PublicDocuments_Kyocera
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x4172ef
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_Kyocera
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x41730a
mov bl, 1
push str._AppData_KyoceraKMnet_Account_Agency_Server
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x417325
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_KyoceraKMnet_Account_Agency
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x417340
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_Policy_Manager
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x41735b
mov bl, 1
push str._UserAppData_Policy_Manager
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x417376
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_NetPolicyManager
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x417391
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._UserAppData_NetPolicyManager
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x4173ac
mov bl, 1
push str._AppData_Account_Agency_Server
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x4173c7
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._AppData_Account_Agency
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x4173e2
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Policy_Manager
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x4173fd
mov bl, 1
push str._ProgramFiles_NetPolicyManager
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x417418
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Kyocera
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x417433
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_UTAX
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x41744e
mov bl, 1
push str._ProgramFiles_Olivetti
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x417469
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Chungho
lea edx, [esp + 0x278]
push edx
call fcn.00442110
test eax, eax
je 0x417484
mov bl, 1
mov ecx, dword [ebp + 0xc]
push str._ProgramFiles_Lenovo
lea eax, [esp + 0x278]
push eax
call fcn.00442110
test eax, eax
je 0x41749f
mov bl, 1
push str._ProgramFiles_ClientTool
lea ecx, [esp + 0x278]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442110
test eax, eax
je 0x417501
mov bl, 1
jmp 0x417501
cmp byte [esi + 0x1c2cc], 0
je 0x4174da
cmp dword [esi + 0x1c2c8], 0
jg 0x4174d2
xor ecx, ecx
jmp 0x4174e8
lea ecx, [esi + 0x32c8]
jmp 0x4174e8
xor ecx, ecx
cmp dword [esi + 0x1c2c8], ecx
setle cl
dec ecx
and ecx, esi
lea edx, [esp + 0x274]
nop
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x4174f0
inc edi
cmp edi, dword [esp + 0x18]
jl 0x417116
mov ecx, dword [ebp + 0xc]
push 0x463fc4
lea edx, [esp + 0x278]
push edx
call fcn.00441ee0
lea eax, [esp + 0x274]
push eax
push 0xffffffffffffffff
push 0xf
mov ecx, ebp
call fcn.00415ea0
lea ecx, [esp + 0x274]
push ecx
mov ecx, ebp
call fcn.004160e0
test bl, bl
je 0x41769a
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x274]
push edx
call fcn.00444f80
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x486]
push ecx
mov word [esp + 0x488], ax
call fcn.0044ac90
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [esp + eax + 0x274]
mov word [esp + eax + 0x47c], cx
add eax, 2
test cx, cx
jne 0x417580
lea eax, [esp + 0x47c]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4175a2
mov edx, dword [0x461aa8]
mov ecx, dword [0x461aac]
mov dword [eax], edx
mov dx, word [0x461ab0]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x480]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
setne al
test eax, eax
je 0x417691
mov edx, 0x461aa4
lea ecx, [esp + 0x50]
mov si, word [ecx]
cmp si, word [edx]
jne 0x41761e
test si, si
je 0x41761a
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x41761e
add ecx, 4
add edx, 4
test si, si
jne 0x4175f8
xor ecx, ecx
jmp 0x417623
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x417633
lea edx, [esp + 0x24]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x417691
mov edx, 0x461a9c
lea ecx, [esp + 0x50]
mov si, word [ecx]
cmp si, word [edx]
jne 0x417666
test si, si
je 0x417662
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x417666
add ecx, 4
add edx, 4
test si, si
jne 0x417640
xor ecx, ecx
jmp 0x41766b
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x41767b
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x417691
push 1
push 0
push 0
push 0x8901
mov ecx, ebp
call fcn.00415f80
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4176c1
cmp byte [esp + 0x17], 0
je 0x4176b3
lea ecx, [esp + 0x274]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00442c60
jmp 0x4176c1
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esp + 0x274]
push eax
push 0
push 0xf
mov ecx, ebp
call fcn.00415ea0
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x890]
push ecx
mov ecx, dword [ebp + 4]
inc esi
push esi
push edi
mov dword [esp + 0x2c], esi
call fcn.004090a0
test al, al
jne 0x417070
xor eax, eax
mov ecx, dword [esp + 0x1890]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1878]
xor ecx, esp
call fcn.0044ac80
add esp, 0x1888
ret 4