Well-known software includes text editors, media players, image viewers, networking programs, game programs, messenger programs, etc. As software is getting more valuable, a malicious programmer illegally copies all or part of a valuable program and resells the copied one. Therefore, we need to categorize programs according to their characteristics in order to efficiently detect software theft. In this paper, we propose a technique that effectively classifies Microsoft Windows applications based on dynamic-link libraries. The proposed technique can be used to analyze suspicious programs even when their functions are not known in advance.