Cryptorbit Analysis

I don't have any clue of encryption and such... but here are some clues i found while analysing files manipulated by cryptorbit:

1. Fist Look:
=============

Cryptorbit does 3 things to the file:

 1. Changes the first 512Bytes of the File (Header). The new header is always exactly the same (at least on the machine i examined)
 2. Changes the last 512Bytes of the File ('Footer 1').
 3. Adds 512Bytes to the end of the File ('Footer 2').

2. Comparing files:
===================

2.1: First hint:
----------------
XOR the first Byte of the Original Header with the first Byte of the Encrypted 'Footer 2' is always "0xC3".

Examples:

Orig Header	Footer 2	XOR Value
-----------------------------------------
2D		EE		C3
31		F2		C3
D0		13		C3
...


2.2: Second hint:
-----------------
I compared to files with almost identical original header and footer (First and last 512Bytes). In the coresponding encrypted files
i first thougt, that 'Footer 2' is identical. I found that both encrypted 'Footer 2''s beginn to differ, where the Header of the Original Files beginn to differ.

Original Files

		 File A  		 File A
		---------		---------
Header		|AAAAAAA|		|AABBBBB|	Header differs after Byte no. 0x200
		---------		---------
		|       |		|       |
		|       |		|       |
		---------		---------
Footer		|       |		|       |
		---------		---------

Encrypted Files

		 File A  		 File A
		---------		---------
Header		|ABCDEFG|		|ABCDEFG|	Always the same...
		---------		---------
		|       |		|       |
		|       |		|       |
		---------		---------
Footer 1	|fghijkl|		|mnopqrs|	Seems to be 'random'
		---------		---------
Footer 2	|XXXXXXX|		|XXYYYYY|	Differs after Byte no. 0x200 (Same place as header of orig. File..)
		---------		---------


Please drop a line on pastebin for hints and comments and include the following string, so everyone can find them:
String: "cryptorbit-investigation@pastebin"

Thanks for reading!