101
Windows Defender Anti-virus Bypassed Using Direct Syscalls & XOR Encryption
(cybersecuritynews.com)
This is a most excellent place for technology news and articles.
That's how it was done in the old days to save a few cycles in Z80 assembly. XOR A instead of LD A, 0.
I use that daily in my accelerator work.
Once you learn the trick, you just use it naturally.