Process Environment Block walking

On Windows, code can follow the current thread's TEB to the process's PEB, traverse the PEB loader's list of loaded modules, and inspect a module's PE export tables to resolve API addresses at runtime. Name or export hashing can avoid storing some API names as plain strings. When used to conceal malware API calls and impair static analysis, this is a PEB-based implementation of MITRE ATT&CK T1027.007 (Dynamic API Resolution); it is not a general method for reading arbitrary process data or exfiltrating environment variables.