Function at 0x46eca0
Capabilities:
Check os version
Create thread
Log keystrokes
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd540
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4f8008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, byte [ebp + 0x10]
mov bh, byte [ebp + 0xc]
mov bl, byte [ebp + 8]
push eax
movzx eax, bh
push eax
movzx edi, bl
push edi
push str.Prepare_to_inject_the_key_event:_vkCode___d__release___d__extended___d
push dword [esi + 8]
call fcn.00405550
movzx eax, byte [esi + 4]
add esp, 0x14
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_before:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.00405550
add esp, 0x1c
cmp bl, 0x11
je 0x46ed2a
cmp bl, 0xa3
je 0x46ed2a
cmp bl, 0xa2
je 0x46ed2a
mov al, bh
xor al, 1
jmp 0x46ed30
mov al, bh
xor al, 1
mov byte [esi], al
mov cl, al
cmp bl, 0x12
je 0x46ed41
cmp bl, 0xa5
je 0x46ed41
cmp bl, 0xa4
jne 0x46ed44
mov byte [esi + 1], cl
cmp bl, 0x2e
jne 0x46ed53
mov byte [esi + 2], al
mov cl, al
mov al, byte [esi + 4]
jmp 0x46ed7a
mov cl, byte [esi + 2]
cmp bl, 0x10
je 0x46ed65
cmp bl, 0xa1
je 0x46ed65
cmp bl, 0xa0
jne 0x46ed68
mov byte [esi + 3], al
cmp bl, 0x5b
je 0x46ed77
cmp bl, 0x5c
je 0x46ed77
mov al, byte [esi + 4]
jmp 0x46ed7a
mov byte [esi + 4], al
movzx eax, al
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, cl
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_after:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.00405550
add esp, 0x1c
cmp byte [esi], 0
je 0x46ef62
cmp byte [esi + 1], 0
je 0x46ef62
cmp byte [esi + 2], 0
je 0x46ef62
cmp byte [esi + 4], 0
jne 0x46ef62
cmp byte [esi + 3], 0
jne 0x46ef62
cmp byte [esi + 5], 0
je 0x46ef3e
push str.Try_simulate_the_CtrlAltDel_combination
push dword [esi + 8]
call fcn.00405550
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 8
cmp dword [0x4fcd28], 0
jne 0x46ee15
push 0x4fcd28
mov dword [0x4fcd28], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4fcd28], eax
cmp dword [0x4fcd2c], 6
jb 0x46ee3a
mov ecx, dword [esi + 8]
call fcn.0041c6f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Requested_CtrlAltDel_simulation
push dword [esi + 8]
call fcn.004054f0
mov eax, dword [0x4fcd28]
add esp, 8
test eax, eax
jne 0x46ee73
push 0x4fcd28
mov dword [0x4fcd28], 0x114
call edi
neg eax
sbb eax, eax
and eax, dword [0x4fcd28]
mov dword [0x4fcd28], eax
cmp dword [0x4fcd2c], 6
jae 0x46ee26
test eax, eax
jne 0x46ee9b
push 0x4fcd28
mov dword [0x4fcd28], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4fcd28], eax
cmp dword [0x4fcd38], 2
jne 0x46ee26
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], vtable.Thread.0
push eax
push 4
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x10], 0
push eax
push 0x46e090
push 0
push 0
mov byte [ebp - 0xf], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne byte [ebp - 0x10]
je 0x46eef3
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
mov byte [ebp - 0xf], 1
call fcn.0040a580
cmp byte [ebp - 0x10], 0
je 0x46ef1a
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.Thread.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.The_CtrlAltDel_combination_is_disabled._Ignore_the_Del_key_pressing
push dword [esi + 8]
call fcn.00405550
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xorps xmm0, xmm0
movzx eax, bl
push 0
push edi
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x46], ax
test bh, bh
mov eax, dword [ebp - 0x44]
mov ecx, 2
cmovne eax, ecx
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x44], eax
je 0x46efad
or eax, 1
mov dword [ebp - 0x44], eax
push 0x1c
lea eax, [ebp - 0x4c]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
jne 0x46ee26
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46efec
lea eax, [ebp - 0x30]
push str.SendInput___function_failed
push eax
call fcn.00404c10
add esp, 8
lea eax, [ebp - 0x30]
push 0x4f5fa0
push eax
call fcn.00498498
push eax
push str.SendInput___function_failed:
lea ecx, [ebp - 0x74]
call fcn.0041bc60
push 0x4f60cc
lea eax, [ebp - 0x74]
push eax
call fcn.00498498
int3