A computer-implemented method comprising: receiving data comprising at least a portion of a program comprising machine code; first identifying and retrieving entry point locations that correspond to places within the program at which an operating system or other program initiates execution of the program and execution-relevant metadata of the at least a portion of the program by scanning the program for pre-defined byte sequences, wherein execution-relevant metadata includes one of runtime function information, relocations, exception handler structures or Microsoft Interface Definition Language, MIDL, structures; second identifying regions of code within the at least a portion of the program based on the identified entry point locations and the metadata; first generating, based on the first identifying and the second identifying, a set of possible call sequences for at least one first function that is called by the at least one portion of the program by determining entry points for each of the at least one first function; second generating an application programming interface, API, call graph characterizing the generated set of possible API call sequences for the at least one first function; the second generating comprising: • disassembling the at least a portion of the program into instructions; • organizing the instructions into at least one second function that each comprise a code block, wherein the code block disassembles the at least one second function after branch instructions, and at branch destinations; • constructing a control flow graph characterizing the at least one second function, wherein the control flow graphs is a directed graph in which each instruction or block of one or more instructions is a node and each possible execution transfer is an edge; • extracting API call sequences by traversing the control flow graph; and • determining a relative order of API calls or the relative order of API calls and child function calls so that the API call graph is generated based on the extracted API call sequences according to the determined relative order. receiving data comprising at least a portion of a program comprising machine code; first identifying and retrieving entry point locations that correspond to places within the program at which an operating system or other program initiates execution of the program and execution-relevant metadata of the at least a portion of the program by scanning the program for pre-defined byte sequences, wherein execution-relevant metadata includes one of runtime function information, relocations, exception handler structures or Microsoft Interface Definition Language, MIDL, structures; second identifying regions of code within the at least a portion of the program based on the identified entry point locations and the metadata; first generating, based on the first identifying and the second identifying, a set of possible call sequences for at least one first function that is called by the at least one portion of the program by determining entry points for each of the at least one first function; second generating an application programming interface, API, call graph characterizing the generated set of possible API call sequences for the at least one first function; the second generating comprising: • disassembling the at least a portion of the program into instructions; • organizing the instructions into at least one second function that each comprise a code block, wherein the code block disassembles the at least one second function after branch instructions, and at branch destinations; • constructing a control flow graph characterizing the at least one second function, wherein the control flow graphs is a directed graph in which each instruction or block of one or more instructions is a node and each possible execution transfer is an edge; • extracting API call sequences by traversing the control flow graph; and • determining a relative order of API calls or the relative order of API calls and child function calls so that the API call graph is generated based on the extracted API call sequences according to the determined relative order. • disassembling the at least a portion of the program into instructions; • organizing the instructions into at least one second function that each comprise a code block, wherein the code block disassembles the at least one second function after branch instructions, and at branch destinations; • constructing a control flow graph characterizing the at least one second function, wherein the control flow graphs is a directed graph in which each instruction or block of one or more instructions is a node and each possible execution transfer is an edge; • extracting API call sequences by traversing the control flow graph; and • determining a relative order of API calls or the relative order of API calls and child function calls so that the API call graph is generated based on the extracted API call sequences according to the determined relative order.