A computer-implemented method for detecting malicious software programs, the method comprising: loading at least a portion of a software code of a software program into a system memory, wherein the loading includes dividing the software code into a plurality of code blocks, and loading one or more code blocks into one or more memory buffers; converting the loaded code blocks into a low-level programming language to generate converted code blocks, wherein the converting includes disassembling each code block using a disassembler into assembly-language instructions; simplifying by an optimizer complex instructions in the converted code blocks into basic instructions to generate simplified code blocks, wherein the simplifying includes replacing complex assembly instructions with basic assembly instructions; constructing by the optimizer at least one data flow model of one simplified code block of the simplified code blocks; analyzing by the optimizer dependencies and interrelations of code elements of the data flow model; identifying obfuscated software code elements in the simplified code blocks based on the analysis of the data flow model; optimizing by the optimizer one or more identified obfuscated code elements in the data flow model to generate optimized code blocks; and determining a degree of code obfuscation of at least one optimized code block by comparing the number of instructions in the optimized code block with the number of instructions in the converted code block; and determining in real time based on results of optimization whether the software code is malicious based on the degree of code obfuscation of at least one optimized code block and before completing the optimization of all code blocks of the software program. loading at least a portion of a software code of a software program into a system memory, wherein the loading includes dividing the software code into a plurality of code blocks, and loading one or more code blocks into one or more memory buffers; converting the loaded code blocks into a low-level programming language to generate converted code blocks, wherein the converting includes disassembling each code block using a disassembler into assembly-language instructions; simplifying by an optimizer complex instructions in the converted code blocks into basic instructions to generate simplified code blocks, wherein the simplifying includes replacing complex assembly instructions with basic assembly instructions; constructing by the optimizer at least one data flow model of one simplified code block of the simplified code blocks; analyzing by the optimizer dependencies and interrelations of code elements of the data flow model; identifying obfuscated software code elements in the simplified code blocks based on the analysis of the data flow model; optimizing by the optimizer one or more identified obfuscated code elements in the data flow model to generate optimized code blocks; and determining a degree of code obfuscation of at least one optimized code block by comparing the number of instructions in the optimized code block with the number of instructions in the converted code block; and determining in real time based on results of optimization whether the software code is malicious based on the degree of code obfuscation of at least one optimized code block and before completing the optimization of all code blocks of the software program.