Function at 0x4098fc
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov eax, 0x44335b
call fcn.00420410
sub esp, 0x124
mov eax, dword [0x45b790]
push ebx
push esi
push edi
mov esi, ecx
push str.__xml_version_1.0__encoding_UTF_8____n
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x10], eax
call fcn.00402027
and dword [ebp - 4], 0
push str._CERInfo__n
lea ecx, [ebp - 0x118]
call fcn.00401f38
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x118]
call fcn.004017e4
push esi
lea ecx, [ebp - 0x118]
call fcn.004017e4
call fcn.0043f01d
mov edi, dword [eax + 4]
call fcn.0043939a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x12c], eax
lea eax, [edi + 0xe0]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.004017e4
lea eax, [edi + 0xe4]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0040d6c3
push eax
lea eax, [ebp - 0x128]
push str._AppCDATA____CDATA_
push eax
mov byte [ebp - 4], 2
call fcn.00401763
push str._____AppCDATA__n
push eax
lea eax, [ebp - 0x11c]
push eax
mov byte [ebp - 4], 3
call fcn.00401eba
add esp, 0x20
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 4
call fcn.004017e4
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401139
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x118]
call fcn.004017e4
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x118]
call fcn.004017e4
push str.__CERInfo_
lea ecx, [ebp - 0x118]
call fcn.00401f38
lea eax, [ebp - 0x114]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x124]
call fcn.00402027
cmp dword [ebp - 0x11c], 0
mov byte [ebp - 4], 5
je 0x409b95
cmp dword [ebp - 0x11c], ebx
ja 0x409b95
push str.dmpuserinfo.xml
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00401eba
add esp, 0xc
lea ebx, [esi + 0x18]
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00401703
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00401139
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x11c], eax
jne 0x409aea
push 0x6e
pop esi
jmp 0x409b9a
mov eax, dword [ebp - 0x118]
mov eax, dword [eax - 0xc]
inc eax
push eax
lea ecx, [ebp - 0x118]
call fcn.0040151f
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx - 0xc]
push 0
lea edx, [ebp - 0x130]
push edx
push ecx
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409b28
push 0x1d
jmp 0x409ae4
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.dumpdata.zip
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00401eba
add esp, 0xc
add esi, 0x14
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.00401703
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00401139
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, edi
call fcn.00409f44
push eax
add edi, 0xc4
push edi
push ebx
push esi
call fcn.0040659d
add esp, 0x10
mov esi, eax
jmp 0x409b9a
mov esi, 0xa1
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x12c]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00420db1
leave
ret