Function at 0x403b20
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], edi
xor ebx, ebx
mov esi, 0x7a
test esi, esi
je 0x403bd8
cmp esi, 0x7a
je 0x403b74
cmp esi, 0x103
je 0x403b62
mov dword [esp + 0x18], 1
jmp 0x403ce6
mov eax, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
jmp 0x403ce6
push edi
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x18]
push esi
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 8
test ebx, ebx
mov dword [edi], esi
mov dword [esp + 0x10], esi
jne 0x403bab
lea eax, [esp + 0x10]
push eax
push edi
push ebx
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x403bb8
lea ecx, [esp + 0x10]
push ecx
push edi
push ebx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x403bc3
xor esi, esi
jmp 0x403cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
mov esi, eax
mov dword [esp + 0x14], edx
jmp 0x403cda
mov eax, dword [edi + 0xc]
mov ebp, 8
test eax, 0x100000
jne 0x403bee
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov esi, str.http:__downfile.pcclear.com_koract_PCClearPlus_act_segye.exe
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403c1b
test cl, cl
je 0x403c17
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403c1b
add eax, 2
add esi, 2
test cl, cl
jne 0x403bf7
xor eax, eax
jmp 0x403c20
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403c29
mov ebp, 1
mov eax, dword [esp + 0x1c]
mov esi, str.http:__downfile.pcclear.com_koract_PCClearPlus_act_segye.exe
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403c56
test cl, cl
je 0x403c52
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403c56
add eax, 2
add esi, 2
test cl, cl
jne 0x403c32
xor eax, eax
jmp 0x403c5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403c64
mov ebp, 2
mov eax, dword [esp + 0x1c]
mov esi, str.http:__app.pcclear.com_nacact_PCclear_Kor_Ax.cab
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403c91
test cl, cl
je 0x403c8d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403c91
add eax, 2
add esi, 2
test cl, cl
jne 0x403c6d
xor eax, eax
jmp 0x403c96
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403ca3
test ebp, ebp
jle 0x403cad
cmp ebp, 3
jg 0x403cad
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push edi
push ebx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
test eax, eax
je 0x403cca
xor esi, esi
jmp 0x403cda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403b40
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
test ebx, ebx
je 0x403cfa
push ebx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403b40
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret