It is very unlikely that malware authors will be able to SGX. In fact it is very unlikely that most people will be able to use SGX. This is because Intel has implemented strong cryptographic DRM on SGX.
In order to be able to launch an SGX program, it either needs to be signed directly by Intel, or by another local SGX program that is signed by Intel. Intel has not been forthcoming with details about SGX, but it is clear that only “licensed” developers will be able to use it. “To be fully utilized, Intel SGX [requires] additional software capabilities, which will begin to be delivered by the ecosystem later this year.”† “The SGX software stack [...] is being made available on a licensed basis.”‡ “The SDK is not publicly available.”* You can find more information about how the DRM is implemented at https://jbeekman.nl/blog/2015/10/intel-has-full-control-over-sgx/
To answer your narrower question: SGX programs are not encrypted before launch, so it is possible to analyze the code as you would any other binary. However, it is possible for that program to be a small bootstrap program (stage 1) that talks to an external server over the Internet. The external server could send the important code (stage 2) to the stage 1 program after it has verified that the stage 1 program is launched securely. In this case, you won't be able to analyze the stage 2 program.
Also note that--since SGX programs can't make syscalls--in order for Malware to do anything to your system, there needs to be a insecure wrapper program to actually talk to the system. You will be able to analyze this wrapper program using standard techniques.