hi,
I just open-sourced my tool: Remora Hook.
Win64 API monitor that hooks a target process using Export Address Table (EAT) and Import Address Table (IAT) patching -- no code modification on API bodies, no debugger attachment. Works with both normally compiled executables and heavily obfuscated, packed binaries with multiple unpacking layers, so you get a useful API log without fighting the protector first.
There is also a short demo GIF on the website showing it in action.
https://github.com/arkup/remora