mandiant / capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs
https://github.com/mandiant/capa/
Apache License 2.0
514 stars 157 forks source link

synchronized fn callback execution (extend create-thread.yml)? #872

Open mike-hunhoff opened 7 months ago

mike-hunhoff commented 7 months ago

https://learn.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-initonceexecuteonce

williballenthin commented 7 months ago

that's a neat API, thanks for creating this issue!

i wonder if mutex/sychronization is a better fit than threading. but i guess we can debate this when writing the rule :-)