API_resolve.py

import json
import idaapi
import idc
import idautils
import ida_funcs
from fnvhash import fnv1a_32


def hashing(name):
    return fnv1a_32(name.encode('utf-8'))


def setup(json_file):
    global export_hashes
    exports_json = json.loads(open(json_file, 'rb').read())
    exports_list = exports_json['exports']
    for export in exports_list:
        api_hash = hashing(export)
        export_hashes[api_hash] = export


def resolve_all_APIs(resolve_ea):
    global export_hashes
    if resolve_ea is None:
        print('resolve fails..')
        return

    for ref in idautils.CodeRefsTo(resolve_ea, 1):
        curr_ea = ref
        API_hash = 0

        while True:
            prev_instruction_ea = idc.prev_head(curr_ea)
            if idc.print_insn_mnem(prev_instruction_ea) == 'push':
                API_hash = idc.get_operand_value(
                    prev_instruction_ea, 0)
                break
            curr_ea = prev_instruction_ea

        if API_hash in export_hashes:
            idc.set_cmt(ref, export_hashes[API_hash], 0)
            parent_func_ea = ida_funcs.get_func(ref).start_ea
            idaapi.set_name(parent_func_ea, 'get_' +
                            export_hashes[API_hash], idaapi.SN_FORCE)
    return


export_hashes = {}
setup('exports.json')

# change the address in the parameter to the address of the function resolving the API
resolve_all_APIs(0x100083C0)