Function at 0x40a620
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x23c
push ebx
push ebp
push esi
push edi
call fcn.0040aba0
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
jne 0x40a654
push str._ClearBrowserCache__No_need_to_clear_cache.
call fcn.00401fc0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x23c
ret
call fcn.0040a5b0
mov esi, eax
cmp esi, ebx
jne 0x40a67d
push ebx
push str._ClearBrowserCache_UnKnown_Browser_Type_d_n
call fcn.00401fc0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
cmp esi, 5
jne 0x40a6bc
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
call fcn.0040aa90
add esp, 4
test eax, eax
jne 0x40a6a4
push str._ClearBrowserCache_GetIEVersion_Failed_n
call fcn.00401fc0
add esp, 4
mov ecx, dword [esp + 0x1c]
lea eax, [ecx - 6]
cmp eax, 3
ja case.default.0x40a6b0
jmp dword [eax*4 + 0x40a8c8]
mov esi, 6
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x30]
push 0x103
push edx
push str._temp_ClearCache.exe
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x40a732
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ClearBrowserCache___ExpandEnvironmentStrings_errorCode___d
call fcn.00401fc0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
mov esi, 7
jmp 0x40a6bc
mov esi, 8
jmp 0x40a6bc
push str._ClearBrowserCache__Unknown_IE_version._n
call fcn.00401fc0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
mov edx, dword [0x415718]
mov eax, dword [str.ClearCache.exe]
mov ecx, dword [0x415714]
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
mov ax, word [0x41571c]
mov dword [esp + 0x24], ecx
mov cl, byte [0x41571e]
lea edx, [esp + 0x20]
mov word [esp + 0x2c], ax
push edx
mov byte [esp + 0x32], cl
call fcn.0040abe0
add esp, 4
test eax, eax
jne 0x40a7aa
push str._ClearBrowserCache___FindProcess_ClearCache.exe__need_to_create_ClearCache.exe
call fcn.00401fc0
lea eax, [esp + 0x34]
push eax
call fcn.0040ad50
add esp, 8
test eax, eax
jne 0x40a7aa
push str.CreateExeFile_failed
call fcn.00401fc0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
xor ecx, ecx
cmp esi, 1
mov dword [esp + 0x11], ecx
mov byte [esp + 0x10], bl
mov dword [esp + 0x15], ecx
mov byte [esp + 0x19], cl
jne 0x40a7cc
lea edx, [esp + 0x10]
mov edi, 0x415580
jmp 0x40a831
cmp esi, 2
jne 0x40a7dc
lea edx, [esp + 0x10]
mov edi, 0x4156a0
jmp 0x40a831
cmp esi, 3
jne 0x40a7ec
lea edx, [esp + 0x10]
mov edi, 0x415590
jmp 0x40a831
cmp esi, 4
jne 0x40a7fc
lea edx, [esp + 0x10]
mov edi, 0x415588
jmp 0x40a831
cmp esi, 6
jne 0x40a80c
lea edx, [esp + 0x10]
mov edi, 0x41569c
jmp 0x40a831
cmp esi, 7
jne 0x40a81c
lea edx, [esp + 0x10]
mov edi, 0x415694
jmp 0x40a831
cmp esi, 8
jne 0x40a84e
call fcn.0040b100
mov ebp, eax
lea edx, [esp + 0x10]
mov edi, 0x415690
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x135]
mov byte [esp + 0x134], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ebp
lea edx, [esp + 0x34]
push ecx
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x140]
push str._s__s__d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x148]
push ecx
call fcn.00401fc0
lea edx, [esp + 0x14c]
push edx
call fcn.0040aeb0
add esp, 0x1c
test eax, eax
jne 0x40a644
push str._ClearBrowserCache__RunClearCache_failed
call fcn.00401fc0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret