Function at 0x46fc40
Capabilities:
Check os version
Create thread
Log keystrokes
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf1f0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, byte [ebp + 0x10]
mov bh, byte [ebp + 0xc]
mov bl, byte [ebp + 8]
push eax
movzx eax, bh
push eax
movzx edi, bl
push edi
push str.Prepare_to_inject_the_key_event:_vkCode___d__release___d__extended___d
push dword [esi + 8]
call fcn.00405550
movzx eax, byte [esi + 4]
add esp, 0x14
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_before:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.00405550
add esp, 0x1c
cmp bl, 0x11
je 0x46fcca
cmp bl, 0xa3
je 0x46fcca
cmp bl, 0xa2
je 0x46fcca
mov al, bh
xor al, 1
jmp 0x46fcd0
mov al, bh
xor al, 1
mov byte [esi], al
mov cl, al
cmp bl, 0x12
je 0x46fce1
cmp bl, 0xa5
je 0x46fce1
cmp bl, 0xa4
jne 0x46fce4
mov byte [esi + 1], cl
cmp bl, 0x2e
jne 0x46fcf3
mov byte [esi + 2], al
mov cl, al
mov al, byte [esi + 4]
jmp 0x46fd1a
mov cl, byte [esi + 2]
cmp bl, 0x10
je 0x46fd05
cmp bl, 0xa1
je 0x46fd05
cmp bl, 0xa0
jne 0x46fd08
mov byte [esi + 3], al
cmp bl, 0x5b
je 0x46fd17
cmp bl, 0x5c
je 0x46fd17
mov al, byte [esi + 4]
jmp 0x46fd1a
mov byte [esi + 4], al
movzx eax, al
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, cl
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_after:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.00405550
add esp, 0x1c
cmp byte [esi], 0
je 0x46ff02
cmp byte [esi + 1], 0
je 0x46ff02
cmp byte [esi + 2], 0
je 0x46ff02
cmp byte [esi + 4], 0
jne 0x46ff02
cmp byte [esi + 3], 0
jne 0x46ff02
cmp byte [esi + 5], 0
je 0x46fede
push str.Try_simulate_the_CtrlAltDel_combination
push dword [esi + 8]
call fcn.00405550
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 8
cmp dword [0x4fed30], 0
jne 0x46fdb5
push 0x4fed30
mov dword [0x4fed30], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4fed30], eax
cmp dword [0x4fed34], 6
jb 0x46fdda
mov ecx, dword [esi + 8]
call fcn.0041d860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Requested_CtrlAltDel_simulation
push dword [esi + 8]
call fcn.004054f0
mov eax, dword [0x4fed30]
add esp, 8
test eax, eax
jne 0x46fe13
push 0x4fed30
mov dword [0x4fed30], 0x114
call edi
neg eax
sbb eax, eax
and eax, dword [0x4fed30]
mov dword [0x4fed30], eax
cmp dword [0x4fed34], 6
jae 0x46fdc6
test eax, eax
jne 0x46fe3b
push 0x4fed30
mov dword [0x4fed30], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4fed30], eax
cmp dword [0x4fed40], 2
jne 0x46fdc6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], vtable.Thread.0
push eax
push 4
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x10], 0
push eax
push 0x46f030
push 0
push 0
mov byte [ebp - 0xf], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne byte [ebp - 0x10]
je 0x46fe93
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
mov byte [ebp - 0xf], 1
call fcn.0040a580
cmp byte [ebp - 0x10], 0
je 0x46feba
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.Thread.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.The_CtrlAltDel_combination_is_disabled._Ignore_the_Del_key_pressing
push dword [esi + 8]
call fcn.00405550
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xorps xmm0, xmm0
movzx eax, bl
push 0
push edi
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x46], ax
test bh, bh
mov eax, dword [ebp - 0x44]
mov ecx, 2
cmovne eax, ecx
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x44], eax
je 0x46ff4d
or eax, 1
mov dword [ebp - 0x44], eax
push 0x1c
lea eax, [ebp - 0x4c]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
jne 0x46fdc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46ff8c
lea eax, [ebp - 0x30]
push str.SendInput___function_failed
push eax
call fcn.00404c10
add esp, 8
lea eax, [ebp - 0x30]
push 0x4f7f10
push eax
call fcn.00499438
push eax
push str.SendInput___function_failed:
lea ecx, [ebp - 0x74]
call fcn.0041cde0
push 0x4f803c
lea eax, [ebp - 0x74]
push eax
call fcn.00499438
int3