I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called during a program invocation.
Is there a way to accomplish this?
Dependency Walker is your friend.
Note that it's almost impossible to find out which libraries/entry points a program uses by static analysis alone, since the strings passed to LoadLibrary and GetProcAddress might be obfuscated, i.e. not visible in the binary. Dependency Walker catches those calls at runtime, which means a) you need to run the program - which may not be advisable if it's known malware - and b) it still might miss something if you don't execute that path of code. But within these restrictions, it's about the best you can get.
