Yes but that code is all running in ram, precluding static analysis. You can still dynamically analyse it, but that is much harder. The way I understand it (an

Yes but that code is all running in ram, precluding static analysis. You can still dynamically analyse it, but that is much harder. The way I understand it (and, correct me if I'm wrong) is that the code flows from disk through the aes engine where it is decrypted and then placed in a presumably interesting/hard to reverse place in ram at which point it is executed. I imagine even more interesting things are done to higher value data in ram, but that's not code - because as you said, code has to be decrypted (at the latest) by the time it reaches the registers.