1. A non-transitory machine readable medium, on which are stored instructions, comprising instructions that when executed cause a machine to: receive a file possibly containing malware; identify a logic entity in the file; compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors, comprising instructions that when executed cause the machine to: match the logic entity to a root node of the tree structure; and match succeeding logic entities of the file with the path through the tree structure of structural code pattern descriptors from the root node to a terminal child node of the path; and indicate the file contains malware responsive to matching the chain of logic entities to the path, wherein each of the logic entities is: a process flow statement: a call to application programming interface call or a user-defined function: a definition or modification of a variable: one or more variables passed with a call to an application programming interface or function: or a boundary between two logically separated code blocks.