Modern malware employs disparate anti-analysis techniques to complicate analysis attempts. Among them, API hashing conceals the identity of imported library functions—key indicators for understanding malware behavior—by replacing their standard names with hashed values. Currently, resolving these obfuscated calls relies heavily on manual expertise and community-maintained hash repositories, both of which are time-consuming and difficult to scale. In this work, we explore an automated approach to deobfuscate API hashing. By leveraging dynamic program analysis, we identify and map hash values back to their original function names while also extracting information about the hashing scheme. Our method can then use malware itself as a “hash oracle”, enabling on-demand resolution of standard function names through the malware’s hashing logic, enabling automatic updates of repositories.