generate random numbers using the Delphi LCG

rule:
  meta:
    name: generate random numbers using the Delphi LCG
    namespace: data-manipulation/prng/lcg
    authors:
      - william.ballenthin@mandiant.com
    scopes:
      static: basic block
      dynamic: unsupported  # requires mnemonic features
    mbc:
      - Cryptography::Generate Pseudo-random Sequence [C0021]
    references:
      - https://en.wikipedia.org/wiki/Linear_congruential_generator
      - https://community.osr.com/discussion/130410/generating-random-numbers
  features:
    - and:
      - instruction:
        - mnemonic: imul
        - number: 0x8088405 = multiplier a
      - mnemonic: inc = increment c