Function at 0x46f130
Capabilities:
Check os version
Create thread
Log keystrokes
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bda10
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4fa008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, byte [ebp + 0x10]
mov bh, byte [ebp + 0xc]
mov bl, byte [ebp + 8]
push eax
movzx eax, bh
push eax
movzx edi, bl
push edi
push str.Prepare_to_inject_the_key_event:_vkCode___d__release___d__extended___d
push dword [esi + 8]
call fcn.00405740
movzx eax, byte [esi + 4]
add esp, 0x14
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push 0x4dd1f8
push dword [esi + 8]
call fcn.00405740
add esp, 0x1c
cmp bl, 0x11
je 0x46f1ba
cmp bl, 0xa3
je 0x46f1ba
cmp bl, 0xa2
je 0x46f1ba
mov al, bh
xor al, 1
jmp 0x46f1c0
mov al, bh
xor al, 1
mov byte [esi], al
mov cl, al
cmp bl, 0x12
je 0x46f1d1
cmp bl, 0xa5
je 0x46f1d1
cmp bl, 0xa4
jne 0x46f1d4
mov byte [esi + 1], cl
cmp bl, 0x2e
jne 0x46f1e3
mov byte [esi + 2], al
mov cl, al
mov al, byte [esi + 4]
jmp 0x46f20a
mov cl, byte [esi + 2]
cmp bl, 0x10
je 0x46f1f5
cmp bl, 0xa1
je 0x46f1f5
cmp bl, 0xa0
jne 0x46f1f8
mov byte [esi + 3], al
cmp bl, 0x5b
je 0x46f207
cmp bl, 0x5c
je 0x46f207
mov al, byte [esi + 4]
jmp 0x46f20a
mov byte [esi + 4], al
movzx eax, al
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, cl
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_after:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.00405740
add esp, 0x1c
cmp byte [esi], 0
je 0x46f3f2
cmp byte [esi + 1], 0
je 0x46f3f2
cmp byte [esi + 2], 0
je 0x46f3f2
cmp byte [esi + 4], 0
jne 0x46f3f2
cmp byte [esi + 3], 0
jne 0x46f3f2
cmp byte [esi + 5], 0
je 0x46f3ce
push str.Try_simulate_the_CtrlAltDel_combination
push dword [esi + 8]
call fcn.00405740
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 8
cmp dword [0x4fed28], 0
jne 0x46f2a5
push 0x4fed28
mov dword [0x4fed28], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4fed28], eax
cmp dword [0x4fed2c], 6
jb 0x46f2ca
mov ecx, dword [esi + 8]
call fcn.0041cbb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Requested_CtrlAltDel_simulation
push dword [esi + 8]
call fcn.004056e0
mov eax, dword [0x4fed28]
add esp, 8
test eax, eax
jne 0x46f303
push 0x4fed28
mov dword [0x4fed28], 0x114
call edi
neg eax
sbb eax, eax
and eax, dword [0x4fed28]
mov dword [0x4fed28], eax
cmp dword [0x4fed2c], 6
jae 0x46f2b6
test eax, eax
jne 0x46f32b
push 0x4fed28
mov dword [0x4fed28], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4fed28], eax
cmp dword [0x4fed38], 2
jne 0x46f2b6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], vtable.Thread.0
push eax
push 4
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x10], 0
push eax
push 0x46e520
push 0
push 0
mov byte [ebp - 0xf], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne byte [ebp - 0x10]
je 0x46f383
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
mov byte [ebp - 0xf], 1
call fcn.0040a770
cmp byte [ebp - 0x10], 0
je 0x46f3aa
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.Thread.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.The_CtrlAltDel_combination_is_disabled._Ignore_the_Del_key_pressing
push dword [esi + 8]
call fcn.00405740
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xorps xmm0, xmm0
movzx eax, bl
push 0
push edi
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x46], ax
test bh, bh
mov eax, dword [ebp - 0x44]
mov ecx, 2
cmovne eax, ecx
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x44], eax
je 0x46f43d
or eax, 1
mov dword [ebp - 0x44], eax
push 0x1c
lea eax, [ebp - 0x4c]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
jne 0x46f2b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46f47c
lea eax, [ebp - 0x30]
push str.SendInput___function_failed
push eax
call fcn.00404e00
add esp, 8
lea eax, [ebp - 0x30]
push 0x4f7790
push eax
call fcn.00498928
push eax
push str.SendInput___function_failed:
lea ecx, [ebp - 0x74]
call fcn.0041c130
push 0x4f78bc
lea eax, [ebp - 0x74]
push eax
call fcn.00498928
int3