find base addr of kernel32.dll

mov esi,fs:[0x30]//fs=thread ctrl modole TEB
   mov eax,[esi]+0x0c//process ctrl modole PEB
   mov ebx,[eax+0x1c]
   mov ecx,[ebx]
   mov ebp,[ecx+0x8]
   
   mov eax,[ebp+0x3c]//eax=start of pe header
   mov ecx,[ebp+eax+0x78]//ecx=relative offset of export table

   add ecx, ebp//ecx=absolute addr of export table
   mov eax,ecx
   add eax,0x1c//eax= rva of list functions offset
   mov eax,[eax]
   add eax,ebp
   mov eax,[eax]//first function offset addr
   add eax,ebp//first function absolute addr
   mov edx,eax

   mov ebx,[ecx+0x20]//ebx=relative offset of names table
   add ebx,ebp//ebx= absolute addr of names tables
   mov ebx,[ebx]
   add ebx,ebp// first function name
   xor edi,edi//edi will count through the functions