These user interface and application calls may be captured or intercepted by an in-memory replacement of API call addresses with Capture Agent function addresses, by a renaming of the API library on disk so that the Capture Agent is called in place of the API library which then calls the renamed library, hooks, or other mechanisms.