It's not supposed to really encrypt anything. It's an obfuscation method. It doesn't matter how "broken" it is, as long as anti-virus applications have no idea about how to "decrypt" it.

They might as well XOR'ed the data, but opted in for RC5 for some reason.