How does this demodulator exactly work?
What you have there is a classic, simple data slicer.

D2 and \$C_{p2}\$ form an AM demodulator.  What goes to C6 and R1 is no longer RF.  

C6 and R1 form a sort of high pass filter/differentiator.

R2, C7, and R3 are there to slightly delay the edges of the detected low frequency signal.

U3 is a comparator.  It compares the signal (V+) with the delayed signal (V-.)  

When the signal is higher than the delayed signal (that's the rising edge,) the comparator's output snaps to high.

When the signal is lower than the delayed signal (that's the falling edge,) the comparator's output snaps to low.

The output is a series of pulses that follow the originally transmitted on-off keying from the transmitter.

This simple data slicer will output random "data" when there's no received signal.  The link I posted goes into some detail on how that is avoided with better designs.  It also includes a section on the simple data slicer, though.