Function at 0x46fba0
Capabilities:
Check os version
Create thread
Log keystrokes
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be420
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4fb008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, byte [ebp + 0x10]
mov bh, byte [ebp + 0xc]
mov bl, byte [ebp + 8]
push eax
movzx eax, bh
push eax
movzx edi, bl
push edi
push str.Prepare_to_inject_the_key_event:_vkCode___d__release___d__extended___d
push dword [esi + 8]
call fcn.004063f0
movzx eax, byte [esi + 4]
add esp, 0x14
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push 0x4de1f8
push dword [esi + 8]
call fcn.004063f0
add esp, 0x1c
cmp bl, 0x11
je 0x46fc2a
cmp bl, 0xa3
je 0x46fc2a
cmp bl, 0xa2
je 0x46fc2a
mov al, bh
xor al, 1
jmp 0x46fc30
mov al, bh
xor al, 1
mov byte [esi], al
mov cl, al
cmp bl, 0x12
je 0x46fc41
cmp bl, 0xa5
je 0x46fc41
cmp bl, 0xa4
jne 0x46fc44
mov byte [esi + 1], cl
cmp bl, 0x2e
jne 0x46fc53
mov byte [esi + 2], al
mov cl, al
mov al, byte [esi + 4]
jmp 0x46fc7a
mov cl, byte [esi + 2]
cmp bl, 0x10
je 0x46fc65
cmp bl, 0xa1
je 0x46fc65
cmp bl, 0xa0
jne 0x46fc68
mov byte [esi + 3], al
cmp bl, 0x5b
je 0x46fc77
cmp bl, 0x5c
je 0x46fc77
mov al, byte [esi + 4]
jmp 0x46fc7a
mov byte [esi + 4], al
movzx eax, al
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, cl
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_after:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.004063f0
add esp, 0x1c
cmp byte [esi], 0
je 0x46fe62
cmp byte [esi + 1], 0
je 0x46fe62
cmp byte [esi + 2], 0
je 0x46fe62
cmp byte [esi + 4], 0
jne 0x46fe62
cmp byte [esi + 3], 0
jne 0x46fe62
cmp byte [esi + 5], 0
je 0x46fe3e
push str.Try_simulate_the_CtrlAltDel_combination
push dword [esi + 8]
call fcn.004063f0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 8
cmp dword [0x4ffd28], 0
jne 0x46fd15
push 0x4ffd28
mov dword [0x4ffd28], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4ffd28], eax
cmp dword [0x4ffd2c], 6
jb 0x46fd3a
mov ecx, dword [esi + 8]
call fcn.0041d5e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Requested_CtrlAltDel_simulation
push dword [esi + 8]
call fcn.00406390
mov eax, dword [0x4ffd28]
add esp, 8
test eax, eax
jne 0x46fd73
push 0x4ffd28
mov dword [0x4ffd28], 0x114
call edi
neg eax
sbb eax, eax
and eax, dword [0x4ffd28]
mov dword [0x4ffd28], eax
cmp dword [0x4ffd2c], 6
jae 0x46fd26
test eax, eax
jne 0x46fd9b
push 0x4ffd28
mov dword [0x4ffd28], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x4ffd28], eax
cmp dword [0x4ffd38], 2
jne 0x46fd26
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], vtable.Thread.0
push eax
push 4
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x10], 0
push eax
push 0x46ef80
push 0
push 0
mov byte [ebp - 0xf], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne byte [ebp - 0x10]
je 0x46fdf3
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
mov byte [ebp - 0xf], 1
call fcn.0040b420
cmp byte [ebp - 0x10], 0
je 0x46fe1a
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.Thread.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.The_CtrlAltDel_combination_is_disabled._Ignore_the_Del_key_pressing
push dword [esi + 8]
call fcn.004063f0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xorps xmm0, xmm0
movzx eax, bl
push 0
push edi
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x46], ax
test bh, bh
mov eax, dword [ebp - 0x44]
mov ecx, 2
cmovne eax, ecx
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x44], eax
je 0x46fead
or eax, 1
mov dword [ebp - 0x44], eax
push 0x1c
lea eax, [ebp - 0x4c]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
jne 0x46fd26
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46feec
lea eax, [ebp - 0x30]
push str.SendInput___function_failed
push eax
call fcn.00405ab0
add esp, 8
lea eax, [ebp - 0x30]
push 0x4f88b0
push eax
call fcn.00499378
push eax
push str.SendInput___function_failed:
lea ecx, [ebp - 0x74]
call fcn.0041cb60
push 0x4f89dc
lea eax, [ebp - 0x74]
push eax
call fcn.00499378
int3