Set a breakpoint on LoadLibrary and GetProcAddress. When those are called, figure out where they were called from. Since there is no import table it's probably enumerating the loaded modules, storing it in a variable somewhere, and then calling them directly (rather than through the import table). It's pretty easy to manually simulate GetProcAddres, but LoadLibrary is a bit more complicated, so at the very least it should LoadLibrary(Ex) should will likely get a hit.