Regarding the &#x27;expand 32-byte k&#x27; part:  I&#x27;ve seen other malware that obfuscates its strings that way, by writing them into a buffer using one instruction per character, so you can&#x27;t retrieve them with a simple &#x27;strings&#x27; command.  The thing that bugs me is they&#x27;ve gone to that length to hide the string, but they didn&#x27;t randomize the order of the instructions, and as a result you can trivially retrieve the string with your disassembler.