mimikatz.exe_: enumerate PE sections #1090
Description
Function: 0x4579D5
What it does: Calls EnumerateSecurityPackagesW and iterates the results.
Why it matches: The loop iterates over SecPkgInfo structures. capa confused the struct member access offsets (like 0x6, 0x14) with PE Header offsets (NumberOfSections, SizeOfRawData).