Function at 0x4175e0
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417909
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rdi
test r10, 0x1f
jne 0x4178f7
mov qword [rsp + 0xa0], r10
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x58], rax
cmp r9, r8
je 0x41769a
test r8, r8
je 0x4178f2
mov rcx, rax
mov rax, r9
xor edx, edx
div r8
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rdx, r8
shr r8, 3
mov r9, rsi
shr rsi, 3
mov r12, r8
sub r8, rsi
test r8, r8
jbe 0x417693
mov byte [rsp + 0x30], 1
cmp r8, 1
jbe 0x417689
mov byte [rsp + 0x32], 0x81
lea rsi, [r8 - 1]
mov ebx, 3
jmp 0x4178b0
mov ebx, 2
jmp 0x417765
xor ebx, ebx
jmp 0x417765
xor ebx, ebx
mov rcx, rax
mov edi, 2
mov rax, r11
call fcn.00417a80
mov rdx, rax
shl rax, 3
mov rsi, qword [rsp + 0x88]
nop dword [rax + rax]
cmp rsi, rax
jne 0x4176fe
lea rcx, [rdx + 3]
shr rcx, 2
mov rdx, qword [rsp + 0xa0]
shr rdx, 5
mov rsi, qword [rsp + 0x58]
lea rbx, [rsi + rdx]
lea rax, [rsi + rcx]
mov rcx, rax
sub rbx, rax
mov rax, rcx
call fcn.00467a00
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 0x28], rdx
call fcn.0043aec0
lea rax, [0x008e515a]
mov ebx, 0x2b
call fcn.0043b7c0
mov rax, qword [rsp + 0x28]
nop
call fcn.0043b4c0
lea rax, [0x008d6906]
mov ebx, 0xe
call fcn.0043b7c0
mov rax, qword [rsp + 0x88]
nop
call fcn.0043b4c0
call fcn.0043b120
call fcn.0043af40
lea rax, str.heapBitsSetTypeGCProg:_unexpected_bit_counthttp2:_too_many_1xx_informational_responseshttp2:_unexpected_ALPN_protocol__q__want__qinterrupted_system_call_should_be_restartedmethodValueCallFrameObjs_is_not_in_a_modulemult64bitPow10:_power_of_10_is_out_of_rangemultiple_Read_calls_return_no_data_or_errornet_http:_invalid_header_field_value_for__qnet_http:_timeout_awaiting_response_headersno_multipart_boundary_param_in_Content_Typenon_in_use_span_found_with_specials_bit_setreflect:_Call_with_too_many_input_argumentsreflect:_CallSlice_of_non_variadic_functionreflect:_nil_type_passed_to_Type.Implementsroot_level_max_pages_doesnt_fit_in_summaryruntime.SetFinalizer:_finalizer_already_setruntime.SetFinalizer:_first_argument_is_nilruntime:_casfrom_Gscanstatus_bad_oldval_gpruntime:_heapBitsSetTypeGCProg:_total_bits_runtime:_releaseSudog_with_non_nil_gp.paramruntime:stoplockedm:_lockedg__atomicstatussql:_connection_returned_that_was_never_outtls:_received_malformed_key_share_extensiontransform:_inconsistent_byte_count_returnedunfinished_open_coded_defers_in_deferreturnunknown_runnable_goroutine_during_bootstrapx509:_failed_to_parse_dnsName_constraint__q_using_value_obtained_using_unexported_fieldactive_sweepers_found_at_start_of_mark_phasecipher:_NewGCM_requires_128_bit_block_ciphercompileCallback:_float_results_not_supportedcookiejar:_malformed_cookie_domain_attributecrypto_sha256:_invalid_hash_state_identifiercrypto_sha512:_invalid_hash_state_identifiercrypto_x509:_error_fetching_intermediate:__wencoding_alphabet_contains_newline_charactergcmarknewobject_called_while_doing_checkmarkhttp2:_could_not_negotiate_protocol_mutuallyhttp2:_invalid_Connection_request_header:__qhttp:_Request.ContentLength_d_with_nil_Bodyhttp:_putIdleConn:_too_many_idle_connectionsinsufficient_data_for_calculated_length_typemime:_unexpected_content_after_media_subtypemult128bitPow10:_power_of_10_is_out_of_rangemultipart:_expecting_a_new_Part__got_line__qno_P_available__write_barriers_are_forbiddenout_of_memory_allocating_heap_arena_metadatareflect:_FieldByNameFunc_of_non_struct_type_reflect:_Value.SetIterKey_called_before_Nextreflect:_funcLayout_with_interface_receiver_reflect:_slice_length_out_of_range_in_SetLenruntime:_lfstack.push_invalid_packing:_nodetls:_server_sent_an_incorrect_legacy_versiontls:_servers_Finished_message_was_incorrectunsafe.Slice:_ptr_is_nil_and_len_is_not_zerouse_of_WriteTo_with_pre_connected_connectionx509:_internal_error:_cannot_parse_domain__qx509:_invalid_RDNSequence:_invalid_attributeValue_is_number__but_overflowed_while_parsingbufio.Scanner:_Read_returned_impossible_countcannot_send_after_transport_endpoint_shutdowncharacter_string_exceeds_maximum_length__255_context:_internal_error:_missing_cancel_errorexitsyscall:_syscall_frame_is_no_longer_validheapBitsSetType:_called_with_non_pointer_typehttp:_multipart_handled_by_ParseMultipartFormhttp:_no_Client.Transport_or_DefaultTransporthttp:_putIdleConn:_connection_is_in_bad_stateinvalid_request_:path__q_from_URL.Opaque___qmath_big:_cannot_unmarshal__q_into_a_big.Intnet_http:_internal_error:_connCount_underflowparsing_packing_of_this_section_has_completedproduced_a_trigger_greater_than_the_heap_goalreflect:_internal_error:_invalid_method_indexreflect:_nil_type_passed_to_Type.AssignableToruntime.minit:_duplicatehandle_failed__errnoruntime:_CreateWaitableTimerEx_failed__errnoruntime:_failed_mSpanList.remove_span.npagessqlite_succeeded_without_returning_a_databasetls:_internal_error:_failed_to_update_binderstls:_internal_error:_unexpected_renegotiationtransform:_input_and_output_are_not_identicaltransitioning_GC_to_the_same_state_as_before_tried_to_run_scavenger_from_another_goroutinew_must_be_at_least_2_by_the_definition_of_NAFx509:_IP_constraint_contained_invalid_mask__xx509:_certificate_signed_by_unknown_authorityzero_length_explicit_tag_was_not_an_asn1.Flag__bad_use_of_unsafe.Pointer__try__dcheckptr__nPSSWithSHA256PSSWithSHA384PSSWithSHA512Ed25519___n_t_t_t___experimentsToken__:_____n_t_t_t___gl__:__bytes.Reader.UnreadByte:_at_beginning_of_slicebytes.Reader.UnreadRune:_at
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00439600
cmp rbx, 0x28
jae 0x41788c
mov byte [rsp + rbx + 0x30], pe_nt_image_headers64
lea rsi, [rbx + 1]
jmp 0x417791
mov r8, r12
bts r12, 7
mov byte [rsp + rsi + 0x30], r12b
shr r8, 7
inc rsi
mov r12, r8
cmp r12, 0x80
jb 0x4177ab
nop word [rax + rax]
cmp rsi, 0x28
jb 0x41777a
jmp 0x41787f
cmp rsi, 0x28
jae 0x417872
mov byte [rsp + rsi + 0x30], r12b
inc rsi
lea r8, [rax - 1]
mov rax, r8
jmp 0x4177e0
mov r12, r8
bts r8, 7
mov byte [rsp + rsi + 0x30], r8b
shr r12, 7
inc rsi
mov r8, r12
nop dword [rax]
cmp r8, 0x80
jb 0x4177f1
cmp rsi, 0x28
jb 0x4177c6
jmp 0x417865
cmp rsi, 0x28
jae 0x417856
mov byte [rsp + rsi + 0x30], r8b
lea r8, [rsi + 1]
cmp r8, 0x28
jae 0x417849
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov byte [rsp + rsi + 0x31], 0
mov rax, r11
lea rbx, [rsp + 0x30]
mov edi, 2
call fcn.00417a80
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
imul rdx, rsi
mov rsi, qword [rsp + 0x88]
add rdx, rsi
shr rdx, 3
jmp 0x4176c5
mov rax, r8
mov ecx, 0x28
call fcn.00467360
mov rax, rsi
mov ecx, 0x28
nop
call fcn.00467360
mov rax, rsi
mov ecx, 0x28
call fcn.00467360
mov rax, rsi
mov ecx, 0x28
call fcn.00467360
mov rax, rsi
mov ecx, 0x28
call fcn.00467360
mov rax, rbx
mov ecx, 0x28
call fcn.00467360
mov r8, rsi
bts rsi, 7
mov byte [rsp + rbx + 0x30], sil
shr r8, 7
inc rbx
mov rsi, r8
cmp rsi, 0x80
jb 0x4178c2
cmp rbx, 0x28
jb 0x417899
nop
jmp 0x4178e5
cmp rbx, 0x28
jae 0x4178d5
mov byte [rsp + rbx + 0x30], sil
inc rbx
jmp 0x417765
mov rax, rbx
mov ecx, 0x28
nop dword [rax]
call fcn.00467360
mov rax, rbx
mov ecx, 0x28
call fcn.00467360
call fcn.00437a20
lea rax, [0x008e34f0]
mov ebx, 0x27
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
call fcn.00464c60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x40]
jmp fcn.004175e0