This is very confusing and problematic. For example, in a certain executable, the winsock2 library is imported, but only CERTAIN functions from it are listed in the functions tab. However, they are NOT the only functions that are in use. I'm not sure right now, but it may be that the other functions which ARE in use, do not have the _imp_ prefix in the code, while the ones that are listed, do. But I'm really confused because effectively what I end up with is really misleading.
First, some background. When a binary imports an API function, the operating system loader stores a function pointer to that function in a location specified by metadata in the binary's executable headers. In IDA, on Windows, this section generally is named
.idata and is colored pink. You can see a typical example in the following screenshot:
There are two patterns that code in a binary uses to invoke these imported API functions. First, you might see
call instructions that reference the function pointers in the aforementioned
.idata section directly, as in:
Secondly, for some API functions, the binary might include a so-called "thunk" function, which consists of one single
jmp instruction to the imported function pointer.
Now, on to your question. Only imports with associated thunk functions will end up in the functions window. This is natural, because thunk functions are actual functions, whereas function pointers are not functions (they're pointers). If you want to see the collection of functions imported by a given binary, use the Imports window (View->Open subviews->Imports) instead of the Functions window.