re: Question about tracing a direct pointer call (CryptSIPLoad related)

[Dan Kegel]

Hook the function that returns those pointers, and
have your hooked function return hooked function pointers.

It's not easy, but I think it would work.