How is it possible for malicious programs to hide using polymorphic cryptography when programs must be first compiled into machine code? You cannot cryptographically hide machine code, can you? Then the processor wouldn't be able to execute it. However, wouldn't it be then simple to identify malware threats once it hits machine code in memory?
Polymorphic malware may not do the same actions in the exact same way every time. Antimalware programs will need to be able to interpret the outcome of a set of actions which may not very reliable if the malware author does well with making the actions seem benign and trigger false positives.
Even when boiled down to machine code, you can do the same action in a wide variety of ways. I don't know machine code so I won't write any but for a really simple instance, there are many ways to go about adding two numbers:
x + y = z
x - -y = z
|-x - y| = z
y + x = z
y - -x = z
|-y - x| = z
So even if the program decrypts its own code during runtime to avoid having itself be identified by antimalware software, it can still act in a variety of ways to achieve the same outcome.