Just a small comment on this: "To my surprise, during decryption, AESENC is executed, while AESDEC is not".

Cipher modes like CTR, CFB use the underlying block cipher as a state update function for a keystream generator. The actual encipher, decipher is done separately. This means that the block cipher is used in the same way for both encipher and decipher.