 With the two keys in place, the malware uses the AES algorithm to encrypt traffic using Output Feedback (OFB) mode (Picture courtesy of Wikipedia).  The output of the block cipher encryption is eXclusive OR’ed (XOR’d) with 16 bytes of ciphertext to decrypt.  Each subsequent block of ciphertext will use the previous encrypted data as the IV passed into the block cipher encryption function.