[Rule Idea] - aPLib Compression

Nobody has claimed this yet.

• #310 by @fboldewin — closed without merging

## Prerequisites

* [x] Put an X between the brackets on this line if you have done all of the following:
* Checked that your rule idea isn't already filed: [search](https://github.com/fireeye/capa-rules/issues?q=is%3Aissue+is%3Aopen+)

## Summary
Identify the aPLib compression algorithm

## Examples
Present in sample `5ef7d0c13ec748206da57ce2ed9749936aff69d837d98dd150e43360f59ec63b`
There are implementations on github ex: https://github.com/secretsquirrel/the-backdoor-factory/tree/master/aPLib

## Features
- `0x32335041` AP32 Magic
- `aPLib v1.1.1 – the smaller the better :)` (Strings may not be reliable - easy to modify/remove)
- Constants and operations of the compression algo.

## Additional context

## Rule details

### Namespace
`/data-manipulation/compression/`

### References
- https://ibsensoftware.com/products_aPLib.html
- https://0xc0decafe.com/malware-analysts-guide-to-aplib-decompression/

### Other rule meta information

Start with the sample identified by hash 5ef7d0c13ec748206da57ce2ed9749936aff69d837d98dd150e43360f59ec63b and review the aPLib implementation and references linked in the issue. Inspect the work associated with closed pull request #310 before proceeding. Done means adding a rule under /data-manipulation/compression/ that identifies aPLib using reliable algorithm features rather than strings alone.

Written by the indexing model from the issue text.