go to 401000 and then search for FF25 and you have an entry of the iat... and then you can find the begining and the end. Then set a hardware bp on write on the first iat value and let it run until it has the values which it had when you set the bp. You shoudl be in a loop then where you find a jump which makes the iat working for you .