IDA Python Xor Decode malware strings

If you have an area in memory that is xor obfuscated

debug007:0018FB04 db 0CEh ; Î
debug007:0018FB05 db  27h ; '
debug007:0018FB06 db  9Ch ; œ
debug007:0018FB07 db  1Ah
debug007:0018FB08 db  95h ; •
debug007:0018FB09 db  2Eh ; .
debug007:0018FB0A db  22h ; "
debug007:0018FB0B db  57h ; W
debug007:0018FB0C db  91h ; ‘
debug007:0018FB0D db  21h ; !
debug007:0018FB0E db  57h ; W
debug007:0018FB0F db  3Ah ; :

and you have assembly code that decodes or xors it to get it back to readable value

.text:00401654 mov     eax, [esp+28h+arg_0]
.text:00401658 movzx   ecx, byte ptr [eax]
.text:0040165B movzx   edx, byte ptr [eax+1]
.text:0040165F xor     cl, 0A3h
.text:00401662 xor     dl, 54h
.text:00401665 mov     [esp+28h+memcpySource], cl
.text:00401669 movzx   ecx, byte ptr [eax+2]
.text:0040166D mov     [esp+28h+var_23], dl
.text:00401671 movzx   edx, byte ptr [eax+3]
.text:00401675 not     cl
.text:00401677 xor     dl, 75h
.text:0040167A mov     [esp+28h+var_22], cl
.text:0040167E movzx   ecx, byte ptr [eax+4]
.text:00401682 mov     [esp+28h+var_21], dl
.text:00401686 movzx   edx, byte ptr [eax+5]
.text:0040168A xor     cl, 0E7h
.text:0040168D xor     dl, 44h
.text:00401690 mov     [esp+28h+var_20], cl
.text:00401694 movzx   ecx, byte ptr [eax+6]
.text:00401698 mov     [esp+28h+var_1F], dl
.text:0040169C movzx   edx, byte ptr [eax+7]
.text:004016A0 xor     cl, 4Bh
.text:004016A3 xor     dl, 23h
.text:004016A6 mov     [esp+28h+var_1E], cl
.text:004016AA movzx   ecx, byte ptr [eax+8]
.text:004016AE mov     [esp+28h+var_1D], dl
.text:004016B2 movzx   edx, byte ptr [eax+9]
.text:004016B6 xor     cl, 0BFh
.text:004016B9 xor     dl, 45h
.text:004016BC mov     [esp+28h+var_1C], cl
.text:004016C0 movzx   ecx, byte ptr [eax+0Ah]
.text:004016C4 mov     [esp+28h+var_1B], dl
.text:004016C8 movzx   edx, byte ptr [eax+0Bh]
.text:004016CC xor     cl, 3Bh
.text:004016CF xor     dl, 56h


You can decode or xor it to read it in IDA Python scripting by going to
file -> script command
and entering code like this
where 'd' is filled with the encoded hex values
and the print statements are filled with the individual xor values from the code

from textwrap import wrap
d = "ce279c1a952e22579121573a"
bytes = wrap(d, 2)
for i in range(len(bytes)):
 bytes[i] = int(bytes[i],16)
print(chr(bytes[0] ^ 0xa3))
print(chr(bytes[1] ^ 0x54))
print(chr((~bytes[2]) & 0x000000FF))
print(chr(bytes[3] ^ 0x75))
print(chr(bytes[4] ^ 0xe7))
print(chr(bytes[5] ^ 0x44))
print(chr(bytes[6] ^ 0x4b))
print(chr(bytes[7] ^ 0x23))
print(chr(bytes[8] ^ 0xbf))
print(chr(bytes[9] ^ 0x45))
print(chr(bytes[10] ^ 0x3b))
print(chr(bytes[11] ^ 0x56))


thus in this example
d = "ce279c1a952e22579121573a"
prints out
mscorjit.dll

which is a library the malware is going to load