Function at 0x472d50
Capabilities:
Check os version
Create thread
Log keystrokes
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1d30
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x554008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, byte [ebp + 0x10]
mov bh, byte [ebp + 0xc]
mov bl, byte [ebp + 8]
push eax
movzx eax, bh
push eax
movzx edi, bl
push edi
push str.Prepare_to_inject_the_key_event:_vkCode___d__release___d__extended___d
push dword [esi + 8]
call fcn.00405f20
movzx eax, byte [esi + 4]
add esp, 0x14
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_before:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.00405f20
add esp, 0x1c
cmp bl, 0x11
je 0x472dda
cmp bl, 0xa3
je 0x472dda
cmp bl, 0xa2
je 0x472dda
mov al, bh
xor al, 1
jmp 0x472de0
mov al, bh
xor al, 1
mov byte [esi], al
mov cl, al
cmp bl, 0x12
je 0x472df1
cmp bl, 0xa5
je 0x472df1
cmp bl, 0xa4
jne 0x472df4
mov byte [esi + 1], cl
cmp bl, 0x2e
jne 0x472e03
mov byte [esi + 2], al
mov cl, al
mov al, byte [esi + 4]
jmp 0x472e2a
mov cl, byte [esi + 2]
cmp bl, 0x10
je 0x472e15
cmp bl, 0xa1
je 0x472e15
cmp bl, 0xa0
jne 0x472e18
mov byte [esi + 3], al
cmp bl, 0x5b
je 0x472e27
cmp bl, 0x5c
je 0x472e27
mov al, byte [esi + 4]
jmp 0x472e2a
mov byte [esi + 4], al
movzx eax, al
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, cl
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi]
push eax
push str.The_modifier_states_after:_m_controlIsPressed___d__m_menuIsPressed___d__m_deleteIsPressed___d__m_shiftIsPressed___d__m_winIsPressed___d_
push dword [esi + 8]
call fcn.00405f20
add esp, 0x1c
cmp byte [esi], 0
je 0x473012
cmp byte [esi + 1], 0
je 0x473012
cmp byte [esi + 2], 0
je 0x473012
cmp byte [esi + 4], 0
jne 0x473012
cmp byte [esi + 3], 0
jne 0x473012
cmp byte [esi + 5], 0
je 0x472fee
push str.Try_simulate_the_CtrlAltDel_combination
push dword [esi + 8]
call fcn.00405f20
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 8
cmp dword [0x558e38], 0
jne 0x472ec5
push 0x558e38
mov dword [0x558e38], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x558e38], eax
cmp dword [0x558e3c], 6
jb 0x472eea
mov ecx, dword [esi + 8]
call fcn.0041dad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.Requested_CtrlAltDel_simulation
push dword [esi + 8]
call fcn.00405ec0
mov eax, dword [0x558e38]
add esp, 8
test eax, eax
jne 0x472f23
push 0x558e38
mov dword [0x558e38], 0x114
call edi
neg eax
sbb eax, eax
and eax, dword [0x558e38]
mov dword [0x558e38], eax
cmp dword [0x558e3c], 6
jae 0x472ed6
test eax, eax
jne 0x472f4b
push 0x558e38
mov dword [0x558e38], 0x114
call edi
neg eax
sbb eax, eax
and dword [0x558e38], eax
cmp dword [0x558e48], 2
jne 0x472ed6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], vtable.Thread.0
push eax
push 4
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x10], 0
push eax
push 0x472140
push 0
push 0
mov byte [ebp - 0xf], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
setne byte [ebp - 0x10]
je 0x472fa3
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], vtable.CtrlAltDelSimulator.0
mov byte [ebp - 0xf], 1
call fcn.0041e5f0
cmp byte [ebp - 0x10], 0
je 0x472fca
push 0xffffffffffffffff
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], vtable.Thread.0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.The_CtrlAltDel_combination_is_disabled._Ignore_the_Del_key_pressing
push dword [esi + 8]
call fcn.00405f20
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xorps xmm0, xmm0
movzx eax, bl
push 0
push edi
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x4c], 1
mov word [ebp - 0x48], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [ebp - 0x46], ax
test bh, bh
mov eax, dword [ebp - 0x44]
mov ecx, 2
cmovne eax, ecx
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x44], eax
je 0x47305d
or eax, 1
mov dword [ebp - 0x44], eax
push 0x1c
lea eax, [ebp - 0x4c]
push eax
push 1
call dword [sym.imp.USER32.dll_SendInput]
test eax, eax
jne 0x472ed6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47309c
lea eax, [ebp - 0x30]
push str.SendInput___function_failed
push eax
call fcn.00403f20
add esp, 8
lea eax, [ebp - 0x30]
push 0x552038
push eax
call fcn.0049c518
push eax
push str.SendInput___function_failed:
lea ecx, [ebp - 0x74]
call fcn.0041d050
push 0x552164
lea eax, [ebp - 0x74]
push eax
call fcn.0049c518
int3