Function at 0x40a1c0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40a201
push esi
lea eax, [esp + 0x14]
push str.MonitorName:__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push str.DeleteLanguageMonitor
lea ecx, [esp + 0x18]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00404100
cmp eax, 0xa
jne 0x40a222
push str.SPOOLER
call fcn.00405570
push str.SPOOLER
call fcn.00409a00
add esp, 8
push esi
push 0
push 0
call sub.WINSPOOL.DRV_DeleteMonitorA
test eax, eax
jne 0x40a23f
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x40a26b
push esi
lea edx, [esp + 0x14]
push str.WinAPI_DeleteMonitor__OK_n_Monitor_Point:__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push str.DeleteLanguageMonitor
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x220]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x220]
push edx
call ebx
mov cl, byte [esp + eax + 0x21f]
mov eax, dword [ebp + 8]
cmp cl, 0x5c
push eax
lea ecx, [esp + 0x224]
lea edx, [esp + 0x32c]
push ecx
je 0x40a2c4
push 0x44bbe8
jmp 0x40a2c9
push 0x44bbd0
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp + 0x10]
add esp, 0x10
test eax, eax
je 0x40a309
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x14]
push str.Delete_File:__s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push str.DeleteLanguageMonitor
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [esp + 0x340]
push eax
call esi
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a49a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40a49a
cmp eax, 3
je 0x40a49a
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
push 0x104
lea ecx, [esp + 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x118]
push edx
call ebx
cmp byte [esp + eax + 0x117], 0x5c
je 0x40a3a1
lea edi, [esp + 0x118]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a390
mov ax, word [0x44b63c]
mov word [edi], ax
lea edi, [esp + 0x118]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40a3b0
mov ecx, dword [str.WININIT.INI]
mov edx, dword [0x44bf18]
mov eax, dword [0x44bf1c]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x40a407
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x14]
push str.INITIAL_File:__s_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push str.DeleteLanguageMonitor
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0x130]
push ecx
call esi
cmp eax, 0xffffffff
jne 0x40a43a
test edi, edi
je 0x40a49a
push 0
push str.DeleteLanguageMonitor
push str.Wininit.ini_OPEN_ERROR
jmp 0x40a492
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x32c]
push eax
push str.NULL
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne 0x40a49a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40a49a
push eax
lea ecx, [esp + 0x14]
push str.WritePrivateProfileString_Error:_d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push str.DeleteLanguageMonitor
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x328]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
test esi, esi
jne 0x40a4d2
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40a4d2
push esi
push str.DeleteLanguageMonitor
push str.WinAPI_DeleteFile__ERROR
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret