1. A processor implemented method, comprising: identifying code; decompiling the code using a virus scanner of a security system, wherein the decompiling is an intermediate decompiling and the intermediate decompiling is based on tracing calls in the code or tracing jumps in the code; determining whether the code is unwanted, based on the decompiled code, wherein a determination is made that the code is unwanted if a hash of a first portion of the decompiled code matches a predetermined threshold percentage associated with a first hash of known unwanted code, and wherein the determining includes comparing interdependencies of portions of the decompiled code to interdependencies of portions of the known unwanted code; identifying a second portion of the decompiled code to which the first portion of the decompiled code depends, if it is determined that the hash of the first portion of the decompiled code matches the first hash of known unwanted code; determining whether a hash of the second portion of the decompiled code matches a second hash of known unwanted code; and updating a dissimilarity score associated with an amount of dissimilarity between the hash of the second portion of the decompiled code and the second hash of known unwanted code if it is determined that the hash of the second portion of the decompiled code does not match the second hash of known unwanted code.