There's a neat tool you can use - [ProcMon](https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) - that will reveal what functions are actually being called. Blew my mind when I discovered it.