It looks to me like they are changing the opcodes themselves. Not quite sure WHAT the changes are, as I have no idea what the original executable looks like, but I would guess that they are either changing some data values to improve things, or such.
Edit: And the reason they use XOR is that it's automatically reverting back to the original if you do it again: if we do 4 ^ 5, we end up with 1. 1 ^ 5 gives 4, so we're back to what we had to start with.
--
Mats