One possible way of achieving it is to use the TLS directory entry of the PE file formats headers. TLS stands for Thread Local Storage and its meant to be used to allocate storage for thread-specific data. The TLS structure, IMAGE_TLS_DIRECTORY, pointed to by the TLS directory entry has a small number of fields. The one of special interest is the one pointing to a list of callbacks, AddressOfCallBacks.
