The PEB can be found at fs:[0x30] in the Thread Environment Block for x86 processes as well as at GS:[0x60] for x64 processes.
creates the PEB structure with all necessary information, and then loads the main two DLLs that Windows applications will always need, which are ntdll.dll and kernel32.dll
The head of a doubly-linked list that contains the loaded modules for the process. Each item in the list is a pointer to an LDR_DATA_TABLE_ENTRY structure.
mov eax, [fs:eax + 0x30]saves the address of the PEB structure in eax. Windows uses the fs segment register to store the address of the TEB structure, the address of the PEB structure is located at an offset of 0x30 bytes.