## 6 Reasoning
Finally, the distances between the API call in malware and the API call in goodware were calculated (values expressed in percentage) as shown in Table 7. Thus, the 10 API calls most involved in malware and least involved in goodware are: _LoadLibraryExW_, _LocalAlloc_, _GetProcAddress_, _GetSystemMetrics_, _GetVersionExW_, _GetModuleHandleW_, _CreateFileW_, _RegisterClipboardFormatW_, _LoadLibraryW_, _MapViewOfFileEx_;  
However, the 10 API calls most involved in goodware and least in malware are respectively: _CoUninitialize_, _TerminateProcess_, _MessageBoxW_, _FormatMessageW_, _CoCreateInstance_, _PostQuitMessage_, _TranslateMessage_, _GetWindowRect_, _PostMessageW_, _FreeEnvironmentStringsA_. Let us now seek confirmation of what emerges from these data by analyzing examples of correctly classified malware and goodware and evaluating the related API calls. The following entries are selected from the dataset _malware-analysis-datasets-api-call-sequences_: entries n\({}^{\circ}\) 42,679, 17,006, and 6173 for the goodware class; and entries n\({}^{\circ}\) 41,444, 43,641, 8921 for the malware class. Table 8 shows a chart that highlights the calls made by each entry, focusing on the calls that fall in the top 10 API calls made by malware and goodware (previously reported in Table 6). \begin{table}
\begin{tabular}{c c} \hline \hline
**API Call** & **Distance Value** \\ \hline \hline \begin{tabular}{c} Malware class \\ _LdrGetProcedureAddress_ \\ _LdrGetDllHandle_ \\ _LoadResource_ \\ _FindResourceExW_ \\ _LdrLoadDll_ \\ _GetSystemInfo_ \\ _LoadStringA_ \\ _NtProtectVirtualMemory_ \\ _GetSystemMetrics_ \\ _CryptAcquireContextW_ \\ \hline \hline \end{tabular} & \
\begin{tabular}{c} 1.16378 \\ 0.76617 \\ 0.59114 \\ 0.37002 \\ 0.32114 \\ 0.24794 \\ 0.21848 \\ 0.20139 \\ 0.18984 \\ 0.18984 \\ 0.18984 \\ \hline \hline \end{tabular} \\ \hline
\begin{tabular}{c} Goodware class \\ _NtClose_ \\ _NtCreateFile_ \\ _RegOpenKeyExW_ \\ _NtOpenKey_ \\ _RegCloseKey_ \\ _GetSystemDirectoryW_ \\ _RegQueryValueExW_ \\ _GetSystemWindowsDirectoryW_ \\ _NtOpenSection_ \\ _SetErrorMode_ \\ \hline \hline \end{tabular} \\ \hline \end{tabular}
\end{table} 
Table 6: Top 10 API calls for malware class and goodware class according to the distance measure. CatBoost on dataset _malware-analysis-datasets-api-call-sequences_. Looking at the first record, 8 out of 10 of the most invoked APIs turn out to belong to the table that summarizes the TOP 10 APIs of the Goodware category, 1 API belongs to those typically invoked by malware, 1 API does not belong to the Top 10 ranking. In addition, the same happens in the second and third records, i.e., they show a prevalence of calls belonging to the TOP 10 of goodware. Next, by evaluating the results for the malware class records, the results for the first malware show 6 out of 10 APIs from the Top 10 ranking in malware, and 2 out of 10 belong to the Top 10 ranking in goodware. The remaining two APIs do not belong to the ranking of the experiment. In addition, in the last two records, a similar situation is presented, where the results show a prevalence of calls belonging to the TOP 10 in malware. Thus, the data show a confirmation of the influence of API calls. Now, let analogous evaluations be performed on the _APIMDS_ dataset. Table 9 shows the relevant API calls for three examples chosen for the goodware class (23,235, 23,386, 23,313) and the malware class (22,042, 15,316, 11,972), with similar classification compared to what was already done for the _malware-analysis-datasets-api-call-sequences_ dataset. From Table 7, it can first be seen that, unlike the other dataset, the most frequently used API calls by goodware show rather small distance values. This evaluation follows that they have little power to discriminate in favor of goodware. Focusing on the goodware examples, it appears that, although most of the API calls do not belong to any of the top 10 expressed in the table by category, the presence of at least one of those indicated for the correct category is still relevant.