1. A method of analyzing whether executable code exists within data that signifies a presence of malware, the method comprising: accessing a plurality of values representing the data contained within a memory of a first computer system by (a) retrieving the data directly from at least one memory component contained within the first computer system, or (b) reading the data corresponding to an input stream from a persistent storage device; performing pre-processing on the plurality of values to produce a candidate data subset, the performing of the pre-processing includes (i) determining whether an entropy of the plurality of values exceeds a first threshold and (ii) conducting an analysis of the plurality of values for a presence of string data by determining whether (a) a selected string of the string data satisfies a string length condition and (b) data associated with the plurality of values satisfies a string ratio condition; and responsive to performing the pre-processing on the plurality of values, analyzing the candidate data subset to determine if any executable code is present in the plurality of values, wherein the analyzing of the candidate data subset comprises a disassembly of the candidate data subset including a first pass of scanning the candidate data subset at an offset and performing additional passes by incrementing the offset and scanning a remaining portion of the candidate data subset from the incremented offset, wherein the scanning includes recording a number of different types of machine instructions detected such that a detected ratio of Push, Pop, Mov, Jmp, Xor or Call (PPMJXC) instructions to non-PPMJXC instructions greater than or equal to a predefined threshold is indicative of a presence of executable code.