Benign Download

detectefi.cpp

Contains a GUID-formatted identifier

SHA-256c3a16d9c1a5fc71667a5b1b06b8cf1327d256f67ab2e0cdfdff3210e198931ac

URLhttps://raw.githubusercontent.com/xcat2/xcat-core/refs/heads/master/xCAT-server/share/xcat/netboot/windows/detectefi.cpp

MaleculeH(Po)

Evidence

Contains a GUID-formatted identifier lines 1–13

1/* Compile this with cl.exe from MS SDK, e.g. 'cl efidetect.cpp', that is all. */
2/* IBM(c) 2011 EPL license http://www.eclipse.org/legal/epl-v10.html */
3
4#include <windows.h>
5#include <stdio.h>
6
7
8int main(int argc, char* argv[])
9{
10	GetFirmwareEnvironmentVariableA("","{00000000-0000-0000-0000-000000000000}",NULL,0);
11	if (GetLastError() == ERROR_INVALID_FUNCTION) { // This.. is.. LEGACY BIOOOOOOOOS....
12		printf("Legacy");
13		retur …