I just read the essay by reverser, The "call relocation table' and its importance". I'm working on a program right now that uses a LOT of "call [ebp+14]" type statements.
Is there a better way to find the beginning of the call table? Not all of them are as easy to find (or as small) as the one in reversers essay. I imageine there is something in the PE file header that points to it, any help? Also, are there any other essay's that deal with the subject?

If you use procdump, and use PE Editor, Directory, you will see the Import Table and Import Address Table, Virtual Addresses.

Iprocdump is available at all good tool stores

Additionally you may have to watch what, LoadLibraryA is doing, if the IAT et al is being created at run time.

Kilby...