dll malicious code analysis study of related records

kernel32.dll This is a very common DLL, which contains the core system functions, such as access and manipulate memory, files and hardware, Kernel32.dl etc. 
Advapi32.dll DLL that provides access to the core Windows components, such as service manager the registry and 
USER.DLL DLL contains all of the user interface components, such as User32.dll assembly buttons, scroll bars, and in response to a user operation and control 
Gdi32.dll DLL contains the graphics display functions and operations 
Ntdll.dll this DLL is the Windows kernel interface. Executable files are usually not directly import this function, but imported by Kernel32.dll indirect, if an executable file into the file, which means that the author attempts to use Ntdll.dll those functions are not available to normal Windows program uses. - some hidden features such as process and operation tasks will use this interface 
Wsock32.dll and Ws2_32.dl two networked DLL, visit either - a DLL program is very likely connected to the network, or perform network-related Ws2_32.dll task 
Wininet.dll DLL that contains the higher-level network functions, to achieve as FTP, HTTP and NTP protocols