Function at 0x5e6b7a41
Capabilities:
Encode data using xor
Reference http user-agent string

Disassembly:
mov eax, 0x5e72957d
mov eax, eax
call fcn.5e711585
sub esp, 0x90
nop
nop
nop
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x38], ebx
mov ecx, ecx
mov dword [ebp - 4], 1
mov ecx, ecx
lea eax, [ebp + 0x50]
push ecx
mov ecx, dword [ebp + 0x64]
sub ecx, 0x10
pop ecx
mov ecx, dword [ebp + 8]
cmovae eax, dword [ebp + 0x50]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x60]
nop
nop
nop
push 0x610e7c44
mov dword [ebp - 0x1c], eax
call fcn.5e6b4e05
mov eax, dword [0x610ed732]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x14], ebx
mov eax, eax
mov dword [ebp - 0x30], ebx
push edx
mov edx, eax
and edx, eax
pop edx
jne 0x5e6b7ac7
push str.WinHttpOpen
call fcn.5e6ba7fc
push eax
mov eax, eax
call edi
mov dword [0x610ed732], eax
test word [0x6102eb2a], 0x985f
jns 0x5e717d6c
push ebx
push ebx
mov ecx, ecx
push ebx
push ebx
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_88.0.4324.182_Safari_537.36_Edg_88.0.100.0
call eax
mov ebx, eax
nop
nop
nop
mov dword [ebp - 0x2c], ebx
push ecx
mov ecx, ebx
and ecx, ebx
pop ecx
je 0x5e6b815d
mov eax, dword [0x610ed72e]
push ecx
mov ecx, eax
and ecx, eax
pop ecx
jne 0x5e6b7b1a
push str.WinHttpConnect
mov eax, eax
call fcn.5e6ba7fc
push eax
nop
nop
call edi
mov dword [0x610ed72e], eax
xor ecx, ecx
nop
nop
nop
push ecx
cmp word [0x60fddc61], 0x7579
js 0x5e6bc6c2
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
nop
nop
push ebx
call eax
mov dword [ebp - 0x24], eax
test eax, eax
je 0x5e6b8155
test dword [0x610d3c48], 0x799e2b43
jne 0x5e6b7b86
mov dword [0x68cad0b9], eax
push edx
xchg edi, eax
inc eax
mov byte [ecx + 0x1c470807], bl
mov ch, 0x4e
popal
invalid
push dword [ebp + 0x38]
cmp dword [0x61010778], 0xc79f91a9
je 0x5e6b7bd1
sbb dword [ecx + 0x78], 0x4f8358f0
xchg edi, eax
lds ebx, [eax]
mov edi, 0xf20e6851
aas
mov dl, 0xf4
invalid
mov ecx, 0x1bb
xor esi, esi
push edx
mov dx, word [ebp + 0x24]
sub dx, cx
pop edx
mov eax, 0x800000
lea ecx, [ebp - 0x68]
cmove esi, eax
mov eax, eax
call fcn.5e6b4e05
push str.POST
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.5e6b4e05
push ebx
mov ebx, dword [ebp + 0x4c]
sub ebx, 0
pop ebx
mov byte [ebp - 4], 3
jne 0x5e6b7ca1
mov ecx, ecx
lea edx, [ebp + 0x50]
lea ecx, [ebp - 0x98]
call fcn.5e6b967f
mov eax, eax
push eax
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 4
mov eax, eax
push 0x610e7d60
push eax
mov ecx, ecx
call fcn.5e6b2d33
add esp, 0xc
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 5
nop
nop
nop
push ebx
push eax
lea ecx, [ebp - 0x68]
call fcn.5e6b3388
mov ecx, ecx
push ebx
push 1
nop
nop
nop
lea ecx, [ebp - 0x80]
call fcn.5e6b4aa6
push ebx
mov eax, eax
push 1
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.5e6b4aa6
mov ecx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ecx
mov ebx, 0x610e7d68
nop
nop
push ebx
nop
nop
nop
call fcn.5e6b4d7c
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x50]
nop
call fcn.5e6b4bfa
cmp dword [ebp - 0x54], 8
lea ebx, [ebp - 0x68]
lea eax, [ebp - 0x50]
cmovae ebx, dword [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x3c]
sub ecx, 8
pop ecx
cmovae eax, dword [ebp - 0x50]
mov dword [ebp + 0x4c], eax
cmp dword [0x6105112c], 0xd6a1fec7
js 0x5e6b7d05
cmp bh, byte [edi]
les eax, [edx + 0x40fb2afb]
mov eax, dword [0x610ed72a]
mov eax, 0x5e6bc6c8
ret
or eax, 0xffffffff
pop ebp
mov eax, eax
ret