Indicate string obfuscation presence

[mr-tz]

Even if emulation fails, can FLOSS provide helpful indicators that string obfuscation is used in a sample?

• few strings in binary / specific sections
• functions reference few strings or strings that appear to be obfuscated
• code sequences indicate stackstrings (see yara/capa rules)
• if there are many tight loop functions, emit that the program likely uses tightstrings?