computer programs are preprocessed to produce normalized or standard versions to remove obfuscation that might prevent the detection of embedded malware through comparison with standard malware signatures . the normalization process can provide an unpacking of compressed or encrypted malware , a reordering of the malware into a standard form , and the detection and removal of semantically identified nonfunctional code added to disguise the malware .