Function at 0x4098c9
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov eax, 0x441734
call fcn.0041e7e0
sub esp, 0x124
mov eax, dword [0x459790]
push ebx
push esi
push edi
mov esi, ecx
push str.__xml_version_1.0__encoding_UTF_8____n
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x10], eax
call fcn.0040200e
and dword [ebp - 4], 0
push str._CERInfo__n
lea ecx, [ebp - 0x118]
call fcn.00401f1f
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x118]
call fcn.004017e4
push esi
lea ecx, [ebp - 0x118]
call fcn.004017e4
call fcn.0043d3ed
mov edi, dword [eax + 4]
call fcn.0043776a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x12c], eax
lea eax, [edi + 0xe0]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 1
call fcn.004017e4
lea eax, [edi + 0xe4]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0040d66f
push eax
lea eax, [ebp - 0x128]
push str._AppCDATA____CDATA_
push eax
mov byte [ebp - 4], 2
call fcn.00401763
push str._____AppCDATA__n
push eax
lea eax, [ebp - 0x11c]
push eax
mov byte [ebp - 4], 3
call fcn.00401ea1
add esp, 0x20
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 4
call fcn.004017e4
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x128]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401139
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x118]
call fcn.004017e4
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x118]
call fcn.004017e4
push str.__CERInfo_
lea ecx, [ebp - 0x118]
call fcn.00401f1f
lea eax, [ebp - 0x114]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x124]
call fcn.0040200e
cmp dword [ebp - 0x11c], 0
mov byte [ebp - 4], 5
je 0x409b62
cmp dword [ebp - 0x11c], ebx
ja 0x409b62
push str.dmpuserinfo.xml
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00401ea1
add esp, 0xc
lea ebx, [esi + 0x1c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00401703
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00401139
mov eax, dword [ebx]
xor ecx, ecx
push ecx
push 0x80
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x11c], eax
jne 0x409ab7
push 0x6e
pop esi
jmp 0x409b67
mov eax, dword [ebp - 0x118]
mov eax, dword [eax - 0xc]
inc eax
push eax
lea ecx, [ebp - 0x118]
call fcn.0040151f
mov ecx, dword [ebp - 0x118]
mov ecx, dword [ecx - 0xc]
push 0
lea edx, [ebp - 0x130]
push edx
push ecx
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409af5
push 0x1d
jmp 0x409ab1
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.dumpdata.zip
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00401ea1
add esp, 0xc
add esi, 0x18
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.00401703
mov ecx, dword [ebp - 0x120]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00401139
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, edi
call fcn.00409f11
push eax
add edi, 0xc4
push edi
push ebx
push esi
call fcn.00406561
add esp, 0x10
mov esi, eax
jmp 0x409b67
mov esi, 0xa1
mov ecx, dword [ebp - 0x124]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x12c]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0x118]
add ecx, 0xfffffff0
call fcn.00401139
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0041f181
leave
ret