Function at 0x415de0
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rdi, rax
or rax, rbx
or rax, rcx
nop word [rax + rax]
test rax, 7
jne 0x41623a
cmp byte [0x00bc2244], 0
je 0x415f6e
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rdi]
mov rdx, rax
shr rax, 0x16
shr rdx, 0x2a
cmp rdx, 0x40
jb 0x415e3e
xor r8d, r8d
jmp 0x415e87
lea r8, [0x00b940b0]
mov r8, qword [r8 + rdx*8]
test r8, r8
je 0x415e84
mov r9, rax
and eax, 0xfffff
mov r8, qword [r8 + rax*8]
test r8, r8
je 0x415e7c
mov rax, rdi
shr rdi, 0xd
and edi, 0x1ff
mov r8, qword [r8 + rdi*8 + 0x20000]
mov rdi, rax
mov rax, r9
jmp 0x415e87
mov rax, r9
xor r8d, r8d
jmp 0x415e87
xor r8d, r8d
test r8, r8
je 0x415f50
mov sil, byte [r8 + 0x63]
cmp sil, 1
jne 0x415f46
nop
cmp qword [r8 + 0x18], rdi
ja 0x415f46
cmp qword [r8 + 0x70], rdi
jbe 0x415f46
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
cmp rdx, 0x40
jae 0x41622d
lea r8, [0x00b940b0]
mov rdx, qword [r8 + rdx*8]
test byte [rdx], al
mov r8, rax
and eax, 0xfffff
mov rdx, qword [rdx + rax*8]
test rdx, rdx
je 0x415f0e
mov r9, rdi
shr rdi, 5
and edi, 0x1ffff
lea r10, [rdx + rdi]
mov r11, r9
shr r9, 3
and r9d, 3
add rdx, 0x1ffff
jmp 0x415f1c
mov r11, rdi
xor r8d, r8d
xor r9d, r9d
xor edx, edx
xor r10d, r10d
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rsi
test rbx, rbx
jne 0x415f3a
xor eax, eax
jmp 0x416136
mov qword [rsp + 0x78], rbx
xor eax, eax
jmp 0x416028
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdx, qword [0x00b6a5c8]
test rdx, rdx
je 0x415f65
mov r8, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x415f6a
xor edx, edx
xor r8d, r8d
xor eax, eax
jmp 0x415f80
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
inc rax
nop dword [rax + rax]
cmp rdx, rax
jle 0x415fba
mov r9, qword [r8 + rax*8]
mov r10, qword [r9 + 0xd0]
cmp rdi, r10
jb 0x415f78
cmp qword [r9 + 0xd8], rdi
jbe 0x415f78
mov rax, rdi
sub rdi, r10
mov rsi, qword [r9 + 0x1f8]
call fcn.00416460
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdx, qword [0x00b6a5c8]
test rdx, rdx
je 0x415fcf
mov r8, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x415fd4
xor edx, edx
xor r8d, r8d
xor eax, eax
jmp 0x415fe0
inc rax
nop dword [rax + rax]
cmp rdx, rax
jle 0x41601a
mov r9, qword [r8 + rax*8]
mov r10, qword [r9 + 0xe0]
cmp rdi, r10
jb 0x415fd8
cmp qword [r9 + 0xe8], rdi
jbe 0x415fd8
mov rax, rdi
sub rdi, r10
mov rsi, qword [r9 + 0x208]
call fcn.00416460
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
add rax, 8
cmp rcx, rax
jbe 0x416128
mov qword [rsp + 0x30], rax
movzx r12d, byte [r10]
bt r12d, r9d
nop
jae 0x4160cc
lea r12, [rax + r11]
lea r13, [rax + rbx]
mov r15, qword [rsi + 0x1268]
mov r12, qword [r12]
mov r13, qword [r13]
mov qword [r15], r12
mov qword [r15 + 8], r13
mov r12, qword [rsi + 0x1268]
add r12, 0x10
mov qword [rsi + 0x1268], r12
cmp qword [rsi + 0x1270], r12
jne 0x4160cc
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x2c], r8d
xor eax, eax
xor ebx, ebx
call fcn.00432320
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x2c]
mov r9d, dword [rsp + 0x28]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x40]
cmp r9d, 3
jae 0x4160da
inc r9d
jmp 0x416024
cmp rdx, r10
je 0x4160ea
inc r10
xor r9d, r9d
jmp 0x416024
mov rax, r10
mov ebx, r9d
mov ecx, r8d
mov rdi, rdx
call fcn.00415bc0
mov rsi, qword [rsp + 0x58]
mov r11, qword [rsp + 0x40]
mov r8d, ecx
mov r9d, ebx
mov rdx, rdi
mov r10, rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
jmp 0x416024
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
add rax, 8
cmp rcx, rax
jbe 0x416128
mov qword [rsp + 0x38], rax
movzx r12d, byte [r10]
bt r12d, r9d
jae 0x4161d1
lea r12, [rax + r11]
mov r13, qword [rsi + 0x1268]
mov r12, qword [r12]
mov qword [r13], r12
mov qword [r13 + 8], 0
mov r12, qword [rsi + 0x1268]
add r12, 0x10
mov qword [rsi + 0x1268], r12
nop dword [rax + rax]
cmp qword [rsi + 0x1270], r12
jne 0x4161d1
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x2c], r8d
mov dword [rsp + 0x28], r9d
xor eax, eax
xor ebx, ebx
call fcn.00432320
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x2c]
mov r9d, dword [rsp + 0x28]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x40]
cmp r9d, 3
jae 0x4161e0
inc r9d
jmp 0x416132
cmp rdx, r10
je 0x4161f0
inc r10
xor r9d, r9d
jmp 0x416132
mov rax, r10
mov ebx, r9d
mov ecx, r8d
mov rdi, rdx
nop dword [rax]
call fcn.00415bc0
mov rsi, qword [rsp + 0x58]
mov r11, qword [rsp + 0x40]
mov r8d, ecx
mov r9d, ebx
mov rdx, rdi
mov r10, rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
jmp 0x416132
mov rax, rdx
mov ecx, 0x40
call fcn.00467380
lea rax, [0x008e3b13]
mov ebx, 0x28
call fcn.00439600
nop
int3