Function at 0x40ba00
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x23c
push ebx
push ebp
push esi
push edi
call fcn.0040c050
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
jne 0x40ba34
push str._ClearBrowserCache__No_need_to_clear_cache.
call fcn.00402970
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x23c
ret
call fcn.0040b990
mov esi, eax
cmp esi, ebx
jne 0x40ba5d
push ebx
push str._ClearBrowserCache_UnKnown_Browser_Type_d_n
call fcn.00402970
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
cmp esi, 5
jne 0x40ba9c
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
call fcn.0040bf40
add esp, 4
test eax, eax
jne 0x40ba84
push str._ClearBrowserCache_GetIEVersion_Failed_n
call fcn.00402970
add esp, 4
mov ecx, dword [esp + 0x1c]
lea eax, [ecx - 6]
cmp eax, 3
ja case.default.0x40ba90
jmp dword [eax*4 + 0x40bca8]
mov esi, 6
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x30]
push 0x103
push edx
push str._temp_ClearCache.exe
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x40bb12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ClearBrowserCache___ExpandEnvironmentStrings_errorCode___d
call fcn.00402970
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
mov esi, 7
jmp 0x40ba9c
mov esi, 8
jmp 0x40ba9c
push str._ClearBrowserCache__Unknown_IE_version._n
call fcn.00402970
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
mov edx, dword [0x41a908]
mov eax, dword [str.ClearCache.exe]
mov ecx, dword [0x41a904]
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
mov ax, word [0x41a90c]
mov dword [esp + 0x24], ecx
mov cl, byte [0x41a90e]
lea edx, [esp + 0x20]
mov word [esp + 0x2c], ax
push edx
mov byte [esp + 0x32], cl
call fcn.0040c090
add esp, 4
test eax, eax
jne 0x40bb8a
push str._ClearBrowserCache___FindProcess_ClearCache.exe__need_to_create_ClearCache.exe
call fcn.00402970
lea eax, [esp + 0x34]
push eax
call fcn.0040c270
add esp, 8
test eax, eax
jne 0x40bb8a
push str.CreateExeFile_failed
call fcn.00402970
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret
xor ecx, ecx
cmp esi, 1
mov dword [esp + 0x11], ecx
mov byte [esp + 0x10], bl
mov dword [esp + 0x15], ecx
mov byte [esp + 0x19], cl
jne 0x40bbac
lea edx, [esp + 0x10]
mov edi, str.firefox
jmp 0x40bc0a
cmp esi, 2
jne 0x40bbbc
lea edx, [esp + 0x10]
mov edi, str.chrome
jmp 0x40bc0a
cmp esi, 3
jne 0x40bbcc
lea edx, [esp + 0x10]
mov edi, str.opera
jmp 0x40bc0a
cmp esi, 4
jne 0x40bbdc
lea edx, [esp + 0x10]
mov edi, str.safari
jmp 0x40bc0a
cmp esi, 6
jne 0x40bbec
lea edx, [esp + 0x10]
mov edi, 0x41a894
jmp 0x40bc0a
cmp esi, 7
jne 0x40bbfc
lea edx, [esp + 0x10]
mov edi, str.IE78
jmp 0x40bc0a
cmp esi, 8
jne 0x40bc27
lea edx, [esp + 0x10]
mov edi, 0x41a888
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0x135]
mov byte [esp + 0x134], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ebp
lea edx, [esp + 0x34]
push ecx
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x140]
push str._s__s__d
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea ecx, [esp + 0x134]
push ecx
push str._clearcache___s
call fcn.00402970
lea edx, [esp + 0x13c]
push edx
call fcn.0040c3d0
add esp, 0xc
test eax, eax
jne 0x40ba24
push str._ClearBrowserCache__RunClearCache_failed
call fcn.00402970
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret