1. A system, comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perfonn operations comprising: receiving an application infected with a malicious code; determining system calls corresponding to the malicious code based on the application infected with the malicious code; generating a first programming code based on the system calls; augmenting the first programming code to create a second programming code, the second programming code being different from the first programming code; and testing that the second programming code achieves an objective that is the same as the malicious code.