I have the following lines push [ebp+dwBytes] push 8                 ; dwFlags call ds:GetProcessHeap push eax               ; hHeap call ds:HeapAlloc       push [ebp:lpCmdLine]   ; char * mov edi, eax call _atol mov esi, eax xor esi, 28Ch mov eax, esi pop ecx mov edx, ebx xor eax, 1104h xor ecx, ecx shr edx, 1 jz  short loc_60114AThe first part is not difficult. They get a handle to the default heap and after that, they allocate some memory on that heap using the handle hHeap. The part with lpCmdLine take the lpCmdLine and converts it into a long value.Now, I do not understand the part which comes after call _atol.Especially the lines with the XOR : xor esi, 28ChQuestions:a) Is that a way of encryption ? I mean, is it so that they try to encrypt the string pointed by lpCmdLine ? b) Normally I had a cmp before jz, but here as you can see, there is only a jz instruction? Why is the cmp is missing ? best regards, 
XORing command-line for encryption?
assembly;xor