__m128i ModuleName;
__m128i ProcName;

ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64;
ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64;
ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64;
ProcName.m128i_i64[1] = 0xD8855EB576AF36CCui64;

ModuleName = _mm_xor_si128(_mm_load_si128(&ModuleName), ProcName);

Above is a snippet of code from a decompiled program that encodes(?) their strings.

ModuleName.m128i_i8 yields the string that is created in the code.

Is there any method (possibly with IDAPython or just tool already built-in) that can be used to simplify that code snippet into just ModuleName = "ntdll.dll"? (I had to compile a program to simplify it to that string)

If assembly is needed, I'll provide it.

  • Do you know the platform, CPU architecture, and used programming language?
    – Robert
    Commented Mar 3 at 11:59

1 Answer 1


I am not sure if i understand your query

have you tried simply evaluating the xor in idc prompt


should spit out dec,hex,oct,bin,and ascii outputs as below

661441346615431072156o 0110110001100100001011100110110001101100011001000111010001101110b 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.