XProtect internals are detailed by @birchb0y (It uses a 64bit key/loops over data to decrypt each byte.  Compiler generates some fancy shifts, but really its just:

for (size_t i = 0; i &lt; length; i++)
   data[i] ^= ((uint8_t*)&amp;key)[i % sizeof(key)];