Regarding the 'expand 32-byte k' part: I've seen other malware that obfuscates its strings that way, by writing them into a buffer using one instruction per ch

Regarding the 'expand 32-byte k' part: I've seen other malware that obfuscates its strings that way, by writing them into a buffer using one instruction per character, so you can't retrieve them with a simple 'strings' command. The thing that bugs me is they've gone to that length to hide the string, but they didn't randomize the order of the instructions, and as a result you can trivially retrieve the string with your disassembler.