Intercepting function calls. In one embodiment of the application, an import address table for an application is accessed and an address, in the import address table, associated with a function to which calls from the application are to be intercepted is replaced with an address to be used to access a proxy function. In another embodiment, the application is loaded in debugging mode. Once the import address table for the application has been populated with addresses for functions called by the application, the execution of the application is paused. An address, in the import address table, associated with a function to which calls from the application are to be intercepted is replaced with an address to be used to access a proxy function. Execution of the application is then resumed.