Methods, apparati, and computer-readable media for determining whether computer code (30) contains malicious code. In a method embodiment, the computer code (30) is optimized (40) to produce optimized code; and the optimized code is subject to a malicious code detection protocol. In an embodiment, the optimizing (40) comprises at least one of constant folding (53), copy propagation (54), non-obvious dead code elimination (62,63), code motion (49), peephole optimization (52), abstract interpretation (59,68), instruction specialization (55), and control flow graph reduction (44).