An example in C/C++ of how we can remove static string & function call references by using obfuscation paired with runtime function pointers. As a result, static analysis using tools such as IDA or x64Dbg increases in time/difficulty. You may be able to hide specific API calls from anti-malware systems. On the other hand, some AVs might also flag this behavior as being malicious due to there being a lack of "real looking behavior" in the binary.

This wiki is intended to provide a resource for setting up a resilient Red Team infrastructure. It was made to complement Steve Borosh (@424f424f) and Jeff Dimmock's (@bluscreenofjeff) BSides NoVa 2017 talk "Doomsday Preppers: Fortifying Your Red Team Infrastructure" (slides)

In practice, Chrome usually turns on remote debugging, which is a very risky approach.

Now, you can automatically trace and watch any Windows API function a binary uses, whether imported or *dynamically resolved*.

+ Windows Internals
+ Windows Debugging and Troubleshooting
+ Windows Performance
+ Windows Programming

References
Glory Sprout string decryptor:
gsprout_string_decryption.py
Glory Sprout Hash resolver:
gsprout_api_resolver.py
GlorySprout sample:
Malwarebazaar
Insight from GlorySprout and Taurus Stelaer:
RussianPanda Research Blog
Let’s play (again) with Predator the thief
An In-Depth analysis of the new Taurus Stealer