check out how @d35haX / CallObfuscator plays with rax to avoid the obvious PEB access via gs:60h.

this nicely bypasses the rules from the Trade War presentation (https://github.com/comaeio/OPCDE/raw/master/2019/Emirates/Trade%20War%20Shellcode%20Wielding%20of%20Imports%20and%20Exports%20-%20Willi%20Ballenthin.pdf).