Function at 0x46cb8f
Capabilities:
Check os version
Delete file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5302d9
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x58e700]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e700]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 0x6e4], ebp
jne 0x46cbdd
mov al, 1
jmp 0x46cde5
sub esp, 0x18
lea esi, [edi + 0x6d4]
mov ecx, esp
push esi
call fcn.0044f85d
call fcn.004841fd
add esp, 0x18
mov edx, 0x5666b8
mov ecx, esi
mov bl, al
call fcn.00465295
test al, al
je 0x46cde3
mov esi, 0x114
lea eax, [esp + 0x54]
push esi
push ebp
push eax
call fcn.00507230
add esp, 0xc
mov dword [esp + 0x54], esi
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x5666c0
push 0x69
push ebp
call esi
mov ebp, eax
test ebp, ebp
je 0x46cde3
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebp
xor ebp, ebp
mov dword [esp + 0x20], eax
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x24]
lea eax, [edi + 0x628]
push 0x5666c8
mov edx, eax
mov dword [esp + 0x18], eax
call fcn.00453d6f
pop ecx
push ebp
push 0x80
push 4
push ebp
mov dword [esp + 0x188], ebp
lea ecx, [esp + 0x34]
cmp dword [esp + 0x48], 8
push ebp
cmovae ecx, dword [esp + 0x38]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp edi, 0xffffffff
je 0x46ccd5
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push 0
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5666e0
push 0x6d
xor edi, edi
push edi
call esi
mov esi, eax
test esi, esi
jne 0x46cced
push edi
jmp 0x46cdd8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
xor esi, esi
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push str.NFWCHK.exe.config
mov ebx, eax
call fcn.00453d6f
pop ecx
push esi
push 0x80
push 4
push esi
mov byte [esp + 0x188], 1
lea ecx, [esp + 0x4c]
cmp dword [esp + 0x60], 8
push esi
cmovae ecx, dword [esp + 0x50]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x46cd61
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push 0
push eax
push ebx
push edi
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x58], 6
lea eax, [esp + 0x24]
push ecx
mov ecx, esp
jae 0x46cd86
cmp dword [esp + 0x3c], 8
cmovae eax, dword [esp + 0x28]
push eax
call fcn.00450c0b
call fcn.004840b2
jmp 0x46cd9b
cmp dword [esp + 0x3c], 8
cmovae eax, dword [esp + 0x28]
push eax
call fcn.00450c0b
call fcn.00483e57
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp al, 1
lea eax, [esp + 0x28]
sete bl
cmp dword [esp + 0x3c], 8
pop ecx
cmovae eax, dword [esp + 0x24]
push eax
call esi
cmp dword [esp + 0x50], 8
lea eax, [esp + 0x3c]
cmovae eax, dword [esp + 0x3c]
push eax
call esi
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.004510f8
push 0
push 1
lea ecx, [esp + 0x2c]
call fcn.004510f8
mov al, bl
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.005026a3
add esp, 0x168
ret