An alternative to reverse engineering malware that is protectively packed, we look at the option of analyzing malware by API calls to determine what a file might be up to. We can determine whether a file may be malicious by its API calls, some of which are typical for certain types for malware. For example, a typical downloader API is URLDownloadToFile. The API GetWindowDC is typical for the screen-grabbers we sometimes see in spyware and keyloggers. The file is packed (with VMProtect), so my disassembler doesnt really know where to start.”]
Source: https://blog.malwarebytes.com/threat-analysis/2017/10/analyzing-malware-by-api-calls/