The BASIC and last block of code are encrypted, and the loader is similar to a Speedlock type standard R-register decrypter
And that's where the problem is - when the decrypter starts for the last code block, R is set at 0x34 and produces garbage
If you set a breakpoint at 0xf09c and set R to become 0x08 then the code will decrypt correctly and the utility will start OK
As for why this actually occurs, I'm not sure - perhaps an issue with the TZX. Could probably be fixed with a patch or something along those lines
Anyway, I digress - while I was looking around I found some curious code at 0x5cde that performs a key scan
Imagine my surprise when this happened! Be patient and wait for the loading screen to render...