Function: 0x4579D5
What it does: Calls EnumerateSecurityPackagesW and iterates the results.
Why it matches: The loop iterates over SecPkgInfo structures. capa confused the struct member access offsets (like 0x6, 0x14) with PE Header offsets (NumberOfSections, SizeOfRawData).
Function:
0x4579D5What it does: Calls
EnumerateSecurityPackagesWand iterates the results.Why it matches: The loop iterates over
SecPkgInfostructures. capa confused the struct member access offsets (like0x6,0x14) with PE Header offsets (NumberOfSections,SizeOfRawData).