what ways exploit developer use to know what winapi will fetch the connection ?

hello ,

im reading exp-300 , they want to send a tcp request to port 11460 so they put a breakpoint on recv winapi because they guess it will this api .

but i dont want to guess, so is there any ways or tools people use to monitoring winapi being used ?

also other than rohitab app?