1. A system, comprising: a non-transitory memory; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: obtaining an application infected with a malicious code; executing the application to log system calls associated with executing the application, wherein the logged system calls comprise system call parameters and time stamps corresponding to the system calls; extracting, from the logged system calls, a first portion of the logged system calls corresponding to the malicious code based on the system call parameters and the time stamps; decompiling the first portion of the logged system calls to generate a first programming source code corresponding to the malicious code; analyzing the first programming source code to determine a first result associated with executing the malicious code; mutating the first programming source code to create a second programming source code that is a variant of the malicious code; and executing the second programming source code to determine a second result from executing the second programming source code corresponds to the first result associated with executing the malicious code.