...Besides from XOR'ing the message with password after every encryption the key changes pseudorandomly.
The password you provide is hashed ( SHA256 ) and saved into the encrypted file to check if the password provided is correct.This algorithm has limitations in general more the numbers of relative characters in the password to plaintext more secure will be the encryption.
XOR encrypt has a 3.5 of 5 editors rating from softpedia
http://www.softpedia.com/get/Security/Encrypting/XOR-Encrypt.shtml