Short summary: RE it a bunch trying to figure out what was wrong, then stumble across a block that looked encrypted (at the very end of one of the loaded memory segments no less) and just throw it into xorsearch.c to get the answer.