Hi,

does the dll include something like LoadLibrary and GetProcAddr then you may bind the functions FindWindowExA and FindWindowA dynamically. Therefor you may need to add a new section to the binary or find enough free space.
Another solution would be to add a little dll of yours to the program's address space - probably using LoadLibrary - and then to use ReadProcessMemory at the particular address. If you load the process yourself using CreateProcess you don't even have to add a dll to the process.

searchme