rule idea: zlib fast inflate

[mike-hunhoff]

see source: https://github.com/madler/zlib/blob/master/contrib/masmx86/inffas32.asm

I've seen this code used in shellcode; we can hit on the hard-coded strings or the assembly itself.

strings:

• Fast decoding Code from Chris Anderson
• invalid literal/length code
• invalid distance code
• invalid distance too far back

[mike-hunhoff]

probably best to hit on the assembly 🚀