.xpis are just zip files.
You can literally just save them from addons.mozilla.org and look inside - it's js so it's not compiled, and obfuscated code is against Mozilla policy.
Automatic updates are optional too.
Microsoft Application Inspector might be handy for some superficial profiling - https://github.com/microsoft/ApplicationInspector