MOVAPS triggered ACCESS_VIOLATION....

Hi,

I met a malware which has a decryption code in it.
I tried unpack on debugger but it is stucked in mid of decryption.

movaps instruction triggered ACCESS_VIOLATION exception in decryption code.
I doubted it might be a anti debugging technique but it seem to be not.
(they are found in Windows shared libraries too)

I searched about this issue..

movaps instruction is explained like this 

but I don't understand the difference between the situations which can be passed or not.

MOVAPS--Move Aligned Packed Single-Precision Floating-Point Values
> the operand must be aligned on a 16-byte boundary http://qcd.phys.cmu.edu/QCDcluster/intel/vtune/reference/vc181.htm

It is also, 

> To move packed single-precision floating-point numbers to or from unaligned memory locations, use the MOVUPS instruction. 

 Anyway, the difference seem to be aligned/unaligned. 

16 byte boundary alignment is the answer.. 

> which generally means that the data's memory address is a multiple of the data size https://en.wikipedia.org/wiki/Data_structure_alignment 

It will be passed. (12F670 is a mltiple of 0x10.)

movaps xmm1,xmmword ptr ds:[rcx+10]

[rcx+10]=[000000000012F670]=28 E8 42 9D FF FF 88 45 44 48 83 7D 28 00 0F 84

will not be passed.(12F638 is not a multiple of 0x10.)

movaps xmm1,xmmword ptr ds:[rcx+10]

[rcx+10]=[000000000012F638]=B1 01 D5 02 B3 65 AC B0 4C ED 5F FA 80 5B 33 64

To shift stack address is danger, I have tried MOVUPS instruction instead. 

Fortunately it is passed... Decrypted code was executable.

This solution might be bad manner but useful during analysis...

And similar instruction, there is movdqa/movdqu combination.