1. A computer-implemented method comprising: receiving data comprising at least a portion of a program; first identifying and retrieving entry point locations and execution-relevant metadata of the at least a portion of the program; second identifying regions of code within the at least a portion of the program based on the identified entry point locations and the metadata; first generating, based on the first identifying and the second identifying, a set of possible call sequences for at least one function; and second generating an API call graph characterizing the generated set of possible call sequences for the at least one function.