Function at 0x4b9e10
Capabilities:
Check for time delay via queryperformancecounter
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x140
mov esi, esp
mov dword [esi + 0x120], ebp
lea eax, [esi + 0x12c]
mov dword [eax - 8], esp
mov dword [eax + 0xc], 0xffffffff
mov dword [eax + 8], 0x5f0598
mov dword [eax + 4], 0x518920
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
push str.chrome_elf.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test eax, eax
jne 0x4b9ec1
lea edi, [esi + 0x90]
mov ecx, edi
push str.chrome_elf.dll
call fcn.005477d0
mov dword [esi + 0x138], 0
mov ecx, edi
call fcn.004b9d00
mov edi, eax
cmp byte [esi + 0x9b], 0
jns 0x4b9eac
mov eax, dword [esi + 0x90]
mov dword [esi + 0x138], 0xffffffff
push eax
call fcn.0050fc7c
add esp, 4
mov dword [esi + 0x138], 0xffffffff
mov dword [esi + 0x44], 0
test edi, edi
je 0x4b9efb
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.StartAntiLsp
push edi
call ebx
mov ecx, ebx
mov ebx, eax
push str.StopAntiLsp
push edi
call ecx
mov dword [esi + 0x44], eax
test ebx, ebx
je 0x4b9efb
mov ecx, ebx
call dword [section..00cfg]
push 1
push str.software360360se6
push 0x80000001
call ebx
add esp, 0xc
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4b9fc6
xor eax, eax
lea ebx, [esi + 0x90]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebx]
mov edi, dword [ebx + 4]
mov ecx, 0x7bd05af6
cmp ecx, eax
mov ecx, 0x863
sbb ecx, edi
jge 0x4ba9af
mov ecx, dword [0x6c02b0]
mov dword [esi + 4], ecx
mov edx, dword [0x6c02b4]
mov dword [esi], edx
push edx
push ecx
push edi
push eax
mov dword [esi + 0xc], eax
call fcn.00517110
mov dword [esi + 8], edi
mov ebx, edx
mov ecx, eax
mov edi, dword [esi + 4]
mul edi
mov dword [esi + 0x10], eax
mov eax, ecx
imul ecx, dword [esi]
add edx, ecx
imul ecx, ebx, 0xf4240
mov dword [esi + 0x14], ecx
imul ebx, edi
add ebx, edx
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 0x10]
mov edi, dword [esi + 8]
sbb edi, ebx
mov ebx, 0xf4240
mul ebx
mov dword [esi + 8], eax
add edx, dword [esi + 0x14]
mov dword [esi + 0xc], edx
mov eax, ecx
mul ebx
imul ecx, edi, 0xf4240
add edx, ecx
push dword [esi]
push dword [esi + 4]
push edx
push eax
call fcn.00517110
mov ebx, edx
add eax, dword [esi + 8]
adc ebx, dword [esi + 0xc]
mov dword [esi], eax
mov dword [esi + 0xf0], eax
mov dword [esi + 0xf4], ebx
jmp 0x4b9fdf
call dword [section..00cfg]
lea ebx, [esi + 0xf0]
push ebx
call ecx
add esp, 4
mov eax, dword [ebx]
mov dword [esi], eax
mov ebx, dword [ebx + 4]
lea edi, [esi + 0x90]
mov ecx, edi
push str.AntiLsp
call fcn.00547270
mov dword [edi + 0x14], ebx
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [0x5f83a4]
cmp eax, dword [0x5f83a8]
jae 0x4ba032
mov ecx, dword [esi + 0x98]
mov dword [eax + 8], ecx
movsd xmm0, qword [esi + 0x90]
movsd qword [eax], xmm0
movq xmm0, qword [esi + 0xa0]
movq qword [eax + 0x10], xmm0
add eax, 0x18
mov dword [0x5f83a4], eax
jmp 0x4ba054
mov ecx, 0x5f83a0
push edi
call fcn.004bebf0
cmp byte [esi + 0x9b], 0
jns 0x4ba054
push dword [esi + 0x90]
call fcn.0050fc7c
add esp, 4
xor eax, eax
dec eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], eax
mov ecx, dword [fcn.00509260]
cmp ecx, 0x50efc0
jne 0x4ba121
xor eax, eax
lea ebx, [esi + 0x90]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebx]
mov edi, dword [ebx + 4]
mov ecx, 0x7bd05af6
cmp ecx, eax
mov ecx, 0x863
sbb ecx, edi
jge 0x4ba9d8
mov ecx, dword [0x6c02b0]
mov dword [esi + 4], ecx
mov edx, dword [0x6c02b4]
mov dword [esi], edx
push edx
push ecx
push edi
push eax
mov dword [esi + 0xc], eax
call fcn.00517110
mov dword [esi + 8], edi
mov ebx, edx
mov ecx, eax
mov edi, dword [esi + 4]
mul edi
mov dword [esi + 0x10], eax
mov eax, ecx
imul ecx, dword [esi]
add edx, ecx
imul ecx, ebx, 0xf4240
mov dword [esi + 0x14], ecx
imul ebx, edi
add ebx, edx
mov ecx, dword [esi + 0xc]
sub ecx, dword [esi + 0x10]
mov edi, dword [esi + 8]
sbb edi, ebx
mov edx, 0xf4240
mul edx
mov dword [esi + 8], eax
mov ebx, edx
add ebx, dword [esi + 0x14]
mov eax, ecx
mov ecx, 0xf4240
mul ecx
imul ecx, edi, 0xf4240
add edx, ecx
push dword [esi]
push dword [esi + 4]
push edx
push eax
call fcn.00517110
add eax, dword [esi + 8]
adc edx, ebx
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], edx
jmp 0x4ba130
call dword [section..00cfg]
lea eax, [esi + 0x78]
push eax
call ecx
add esp, 4
mov ecx, dword [0x6bedd8]
lea edi, [esi + 0x84]
xor eax, eax
dec eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [esi + 4], ecx
push 4
push str.type
push edi
call fcn.00500040
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4ba167
mov eax, dword [esi + 0x88]
jmp 0x4ba16a
and eax, 0x7f
test eax, eax
jne 0x4ba293
mov dword [esi + 0x138], 1
mov ecx, dword [esi + 4]
push str.waitfor_proc_exit
call fcn.004fd6b0
test al, al
je 0x4ba293
xor eax, eax
dec eax
mov dword [esi + 0x138], eax
lea edx, [esi + 0x90]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [esi + 0x138], 1
mov ecx, dword [esi + 4]
push 0x11
push str.waitfor_proc_exit
push edx
call fcn.00500040
mov dword [esi + 0x138], 0xffffffff
mov dword [esi + 0xf0], 0
movzx eax, byte [esi + 0x9b]
test al, al
jns 0x4ba1ef
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x94]
jmp 0x4ba1f8
and eax, 0x7f
lea edx, [esi + 0x90]
mov dword [esi + 0x138], 5
lea ecx, [esi + 0xf0]
push ecx
push eax
push edx
call fcn.004f9e40
add esp, 0xc
mov ecx, dword [esi + 0xf0]
test ecx, ecx
setne dl
and al, dl
cmp al, 1
jne 0x4ba272
push ecx
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4ba272
push 0xbb8
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi]
test eax, eax
je 0x4ba267
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi]
test eax, eax
jne 0x4ba272
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4ba272
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esi + 0x138], 0xffffffff
cmp byte [esi + 0x9b], 0
jns 0x4ba293
push dword [esi + 0x90]
call fcn.0050fc7c
add esp, 4
movzx eax, byte [esi + 0x8f]
test al, al
jns 0x4ba2a6
mov eax, dword [esi + 0x88]
jmp 0x4ba2a9
and eax, 0x7f
test eax, eax
jne 0x4ba2bc
mov dword [esi + 0x138], 1
call fcn.00578450
mov dword [esi + 0x138], 0xffffffff
push 0x14
call fcn.00510d64
add esp, 4
pxor xmm0, xmm0
movdqu xmmword [eax + 4], xmm0
mov dword [eax], 0x5d58a8
mov edi, dword [0x5f83a0]
cmp dword [0x5f83a4], edi
je 0x4ba9ac
mov ebx, eax
mov eax, dword [esi + 0x78]
mov dword [esi], eax
mov eax, dword [esi + 0x7c]
mov dword [esi + 8], eax
mov ecx, edi
push 0xf
push str.exe_entry_point
call fcn.00508180
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov dword [esi + 0x138], 1
mov dword [esi], ebx
mov ecx, ebx
push 0x5f83a0
push dword [ebp + 8]
call fcn.004bf980
mov dword [esi + 8], eax
mov edi, dword [esi]
lea ecx, [edi + 4]
mov eax, dword [ecx]
test eax, eax
jne 0x4ba5cd
mov dword [esi + 0xc], ecx
xor eax, eax
dec eax
mov dword [esi + 0x138], eax
lea ecx, [esi + 0xf0]
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x20], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [ecx + 0x10], xmm0
movdqa xmmword [ecx], xmm0
mov dword [esi + 0x138], 1
push dword [esi + 4]
call fcn.00564360
xor eax, eax
dec eax
mov dword [esi + 0x138], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x138], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esi + 0x48]
push eax
push ecx
call fcn.004d2300
add esp, 8
movzx eax, byte [esi + 0x53]
test al, al
jns 0x4ba3ba
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
jmp 0x4ba3c0
and eax, 0x7f
lea edx, [esi + 0x48]
mov dword [esi + 0x138], 4
lea ecx, [esi + 0xf0]
push eax
push edx
push 0x11
push str.waitfor_proc_exit
call fcn.005495b0
mov ecx, dword [esi + 4]
push str.waitfor_proc_exit
call fcn.004fd6b0
test al, al
jne 0x4ba570
mov dword [esi + 0x138], 0xffffffff
xor ebx, ebx
lea edi, [esi + 0x18]
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 8], ebx
push edi
push 1
call fcn.0041a930
add esp, 8
push edi
call fcn.00420f30
add esp, 4
test al, al
je 0x4ba55f
xor eax, eax
dec eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
lea eax, [esi + 0x28]
lea ecx, [esi + 0x18]
mov dword [esi + 4], eax
push eax
call fcn.0041a7b0
mov dword [esi + 0x94], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x98], ebx
lea edi, [esi + 0x90]
push edi
push 0xb
push 0x5e22a3
call fcn.004fe880
add esp, 0xc
movzx eax, byte [esi + 0x9b]
test al, al
jns 0x4ba482
mov edi, dword [esi + 0x90]
mov eax, dword [esi + 0x94]
jmp 0x4ba485
and eax, 0x7f
lea edx, [esi + 0x38]
lea ecx, [esi + 0x28]
push eax
push edi
push edx
call fcn.00410a10
cmp byte [esi + 0x9b], 0
jns 0x4ba4aa
push dword [esi + 0x90]
call fcn.0050fc7c
add esp, 4
lea edi, [esi + 0x6c]
lea ebx, [esi + 0x38]
mov ecx, ebx
push 0xa
push str.chrome.dll
push edi
call fcn.00410a10
cmp byte [ebx + 0xb], 0
jns 0x4ba4d0
push dword [esi + 0x38]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x33], 0
jns 0x4ba4e1
push dword [esi + 0x28]
call fcn.0050fc7c
add esp, 4
push edi
call fcn.00420f30
add esp, 4
test al, al
jne 0x4ba54e
xor eax, eax
dec eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
lea edi, [esi + 0x90]
lea ecx, [esi + 0x18]
push edi
call fcn.0041a7b0
mov ecx, edi
push 0xd
push str.new_360se.exe
push ebx
call fcn.00410a10
cmp byte [edi + 0xb], 0
jns 0x4ba52c
push dword [esi + 0x90]
call fcn.0050fc7c
add esp, 4
push ebx
call fcn.00420f30
add esp, 4
test al, al
jne 0x4ba68f
cmp byte [esi + 0x43], 0
jns 0x4ba54e
push dword [esi + 0x38]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x77], 0
jns 0x4ba55f
push dword [esi + 0x6c]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x23], 0
jns 0x4ba570
push dword [esi + 0x18]
call fcn.0050fc7c
add esp, 4
mov dword [esi + 0x138], 4
xor eax, eax
push eax
push 1
push eax
call fcn.00578d60
add esp, 0xc
cmp byte [esi + 0x53], 0
mov dword [esi + 0x138], 0xffffffff
jns 0x4ba5a3
push dword [esi + 0x48]
call fcn.0050fc7c
add esp, 4
mov dword [esi + 0x138], 1
lea ecx, [esi + 0xf0]
call fcn.005644d0
mov dword [esi + 0x138], 0xffffffff
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
test eax, eax
mov edi, dword [esi]
je 0x4ba604
movzx ecx, byte [edi + 0x13]
test cl, cl
jns 0x4ba5d8
mov ecx, dword [edi + 0xc]
test ecx, ecx
jne 0x4ba604
mov dword [esi + 0x138], 0xffffffff
push str.RelaunchChromeBrowserWithNewCommandLineIfNeeded
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ba9ff
mov ecx, eax
call dword [section..00cfg]
call ecx
test edi, edi
je 0x4ba632
mov dword [edi], 0x5d58a0
cmp byte [edi + 0x13], 0
mov dword [esi + 0x138], 0xffffffff
jns 0x4ba629
push dword [edi + 8]
call fcn.0050fc7c
add esp, 4
push edi
call fcn.0050fc7c
add esp, 4
cmp dword [esi + 0x44], 0
je 0x4ba657
mov dword [esi + 0x138], 0xffffffff
mov ecx, dword [esi + 0x44]
call dword [section..00cfg]
mov dword [esi + 0x138], 2
call ecx
cmp byte [esi + 0x8f], 0
mov dword [esi + 0x138], 0xffffffff
jns 0x4ba678
push dword [esi + 0x84]
call fcn.0050fc7c
add esp, 4
mov eax, dword [esi + 0x12c]
mov dword fs:[0], eax
mov eax, dword [esi + 8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esi + 0x11c]
mov dword [edi], 0xffffffff
push ebx
push edi
call fcn.0056ce00
add esp, 8
mov edi, dword [edi]
test edi, edi
je 0x4ba53d
xor ebx, ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov ecx, edi
lea eax, [esi + 0x28]
push eax
push 0x5dea62
call fcn.0056d220
movzx eax, byte [esi + 0x33]
test al, al
jns 0x4ba6d7
mov ecx, dword [esi + 0x2c]
jmp 0x4ba6dc
mov ecx, eax
and ecx, 0x7f
test ecx, ecx
je 0x4ba93a
mov dword [esi + 0x14], edi
xor eax, eax
dec eax
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe8], eax
mov dword [esi + 0xec], eax
lea eax, [esi + 0x60]
lea ecx, [esi + 0x38]
mov dword [esi + 0x80], ecx
mov dword [esi + 0x10], eax
push eax
call fcn.0041a7b0
movzx eax, byte [esi + 0x33]
test al, al
jns 0x4ba724
mov eax, dword [esi + 0x28]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x2c]
jmp 0x4ba727
and eax, 0x7f
lea edi, [esi + 0x54]
push eax
push dword [esi + 4]
push edi
call fcn.00420d40
add esp, 0xc
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4ba747
mov edi, dword [esi + 0x54]
mov eax, dword [esi + 0x58]
jmp 0x4ba74a
and eax, 0x7f
lea ecx, [esi + 0x60]
push eax
push edi
lea ebx, [esi + 0x90]
push ebx
call fcn.00410a10
lea edi, [esi + 0xe4]
mov ecx, ebx
push 0xa
push str.chrome.dll
push edi
call fcn.00410a10
cmp byte [esi + 0x9b], 0
jns 0x4ba787
push dword [esi + 0x90]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x5f], 0
jns 0x4ba798
push dword [esi + 0x54]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x6b], 0
jns 0x4ba7a9
push dword [esi + 0x60]
call fcn.0050fc7c
add esp, 4
push edi
call fcn.00420f30
add esp, 4
test al, al
je 0x4ba91b
xor eax, eax
dec eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
lea edi, [esi + 0x18]
mov ecx, edi
lea ebx, [esi + 0x90]
push ebx
call fcn.0041a7b0
mov ecx, ebx
push 0xd
push str.old_360se.exe
lea eax, [esi + 0x60]
push eax
call fcn.00410a10
cmp byte [esi + 0x9b], 0
jns 0x4ba800
push dword [esi + 0x90]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x6b], 0
jns 0x4ba80c
mov eax, dword [esi + 0x60]
mov dword [esi + 0x10], eax
cmp byte [esi + 0x43], 0
jns 0x4ba81b
mov eax, dword [esi + 0x38]
mov dword [esi + 0x80], eax
cmp byte [esi + 0x23], 0
jns 0x4ba824
mov edi, dword [esi + 0x18]
xor ebx, ebx
push ebx
push ebx
push 2
push dword [esi + 0x10]
push dword [esi + 0x80]
push edi
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
je 0x4ba908
pcmpeqd xmm0, xmm0
lea eax, [esi + 0x94]
movdqa xmmword [eax - 4], xmm0
movdqa xmmword [eax + 0x3c], xmm0
movdqa xmmword [eax + 0x1c], xmm0
movdqa xmmword [eax + 0xc], xmm0
movdqa xmmword [eax + 0x2c], xmm0
mov byte [eax - 4], bl
lea edi, [esi + 0xd4]
mov dword [edi], ebx
mov dword [edi + 4], ebx
pxor xmm0, xmm0
movdqu xmmword [edi - 0x30], xmm0
mov dword [edi - 0x1f], ebx
mov dword [edi - 0x23], ebx
movdqu xmmword [edi - 0x18], xmm0
mov dword [edi - 9], ebx
mov dword [edi - 0x3c], ebx
mov dword [edi - 0x40], ebx
mov dword [edi - 0x39], ebx
mov dword [edi - 0x35], ebx
mov dword [edi - 4], edi
mov byte [edi + 8], bl
lea eax, [esi + 0x54]
lea ecx, [esi + 0x18]
push eax
call fcn.0041a7b0
cmp byte [edi - 0x35], bl
js 0x4ba999
mov eax, dword [esi + 0x5c]
lea ecx, [esi + 0x94]
mov dword [ecx + 8], eax
movq xmm0, qword [esi + 0x54]
movq qword [ecx], xmm0
lea eax, [esi + 0x90]
push eax
lea eax, [esi + 0xf0]
push eax
lea eax, [esi + 0x54]
push eax
call fcn.0056dc10
add esp, 0xc
mov eax, dword [esi + 0x54]
inc eax
cmp eax, 1
ja 0x4baa02
cmp byte [esi + 0x58], 0
setne bl
cmp eax, 2
jae 0x4baa09
lea ecx, [esi + 0x90]
call fcn.0056b340
cmp byte [esi + 0x6b], 0
jns 0x4ba91d
push dword [esi + 0x60]
call fcn.0050fc7c
add esp, 4
jmp 0x4ba91d
xor ebx, ebx
cmp byte [esi + 0xef], 0
jns 0x4ba934
push dword [esi + 0xe4]
call fcn.0050fc7c
add esp, 4
mov al, byte [esi + 0x33]
mov edi, dword [esi + 0x14]
test al, al
jns 0x4ba949
push dword [esi + 0x28]
call fcn.0050fc7c
add esp, 4
mov ecx, edi
call fcn.0056cc30
push edi
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x43], 0
jns 0x4ba96a
push dword [esi + 0x38]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x77], 0
jns 0x4ba97b
push dword [esi + 0x6c]
call fcn.0050fc7c
add esp, 4
cmp byte [esi + 0x23], 0
jns 0x4ba98c
push dword [esi + 0x18]
call fcn.0050fc7c
add esp, 4
test bl, bl
je 0x4ba570
jmp 0x4ba588
push dword [esi + 0x94]
call fcn.0050fc7c
add esp, 4
jmp 0x4ba8b1
int3
mov ecx, 0xf4240
mul ecx
imul ecx, edi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
mov ebx, edx
jmp 0x4b9fb6
mov ecx, 0xf4240
mul ecx
imul ecx, edi, 0xf4240
add ecx, edx
push dword [0x6c02b4]
push dword [0x6c02b0]
push ecx
push eax
call fcn.00517110
jmp 0x4ba119
int3
mov bl, 1
jmp 0x4ba8f4
call fcn.004ee180
push dword [esi + 0x54]
call fcn.00506200
add esp, 4
jmp 0x4ba8fd