@foone are they passing LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE or LOAD_LIBRARY_AS_IMAGE_RESOURCE to LoadLibraryEx? that'd be a giveaway that they're not directly doing imports and there's some extra gubbins in there for yanking out data and maybe executing code.