decoder = "\x48\x31\xC9" + # xor rcx, rcx
"\x48\x81\xE9" + block_count + # sub ecx, block_count
"\x48\x8D\x05\xEF\xFF\xFF\xFF" + # lea rax, [rel 0x0]
"\x48\xBBXXXXXXXX" + # mov rbx, 0x???????????
"\x48\x31\x58\x27" + # xor [rax+0x27], rbx
"\x48\x2D\xF8\xFF\xFF\xFF" + # sub rax, -8
"\xE2\xF4" # loop 0x1B
The block of code can be a bit dense to look at, so let’s break it down a bit:
The first instruction simply zeroes out the RCX register and loads it with the block_count. In our sample code, the block_count is 0xffffffffffffffc0, so the code reflects the following:
rcx, rcx
rcx, 0xffffffffffffffc0