Yeah, I get that, I'm just unconvinced that using lower level, less documented APIs, which are not necessarily meant to be the way users interact with the system, is a good heuristic for malware detection.

I'm ignoring the fact that very few people in the world need an antivirus (other than maybe elderly/less technologically knowledgeable people, but even then I'm not sure they can be fully protected)