“At its code level, the variant’s module names are also obfuscated, making it more challenging to determine the modules’ intent.”