support index based masking strings in TSQL

mask_string.sql

-- You can either pass a format string, or you could store it in a table per row
-- If you want to support additional cases, just modify the last CROSS APPLY 

DECLARE @format_string nvarchar(500) = 'X###XXX###'

SELECT STRING_AGG(result.chars,'') AS strings
FROM sys.objects AS m
CROSS APPLY 
(
	SELECT 
		DISTINCT 
		number		
	FROM master..spt_values AS v 
	WHERE
		v.number BETWEEN 1 and LEN(m.name)
) AS num
CROSS APPLY 
(
	SELECT 
		SUBSTRING(m.name, num.number, 1) AS entity_data,
		SUBSTRING(@format_string, num.number, 1) AS format_data
) AS comp
CROSS APPLY
(
	SELECT 
		CASE 
			WHEN comp.format_data = '#' 
			THEN comp.entity_data
			WHEN comp.format_data = 'x'
			THEN comp.format_data
			ELSE comp.entity_data
		END AS chars
) AS result
GROUP BY
	m.object_id