Meaning of code used to find kernel32.dll in shellcode

Question

I'm attempting to reverse some shellcode created by metasploit to increase my understanding of shellcode. I understand the overall point of the code is attempting to locate kernel32.dll in the list of loaded modules.

seg000:00000006 60                                      pusha
seg000:00000007 89 E5                                   mov     ebp, esp
seg000:00000009 31 D2                                   xor     edx, edx
seg000:0000000B 64 8B 52 30                             mov     edx, fs:[edx+30h] ; Accessing PEB
seg000:0000000F 8B 52 0C                                mov     edx, [edx+0Ch]  ; Access 0x0C PEB offset which is _PEB_LDR_DATA
seg000:00000012 8B 52 14                                mov     edx, [edx+14h]  ; Accesses _PEB_LDR_DATA->InMemoryOrderModuleList
seg000:00000015
seg000:00000015                         loc_15:                                 ; CODE XREF: sub_6+87j
seg000:00000015 8B 72 28                                mov     esi, [edx+28h]
seg000:00000018 0F B7 4A 26                             movzx   ecx, word ptr [edx+26h]
seg000:0000001C 31 FF                                   xor     edi, edi

I'm having some trouble understanding the instructions below. I understand that edx will point to _PEB_LDR_DATA->InMemoryOrderModuleList but why reference edx+28h and then a word of edx+26h? esi and ecx are overwritten in subsequent assembly instructions so I'm not sure what the point is of populating them here.

seg000:00000015 8B 72 28                                mov     esi, [edx+28h]
seg000:00000018 0F B7 4A 26                             movzx   ecx, word ptr [edx+26h]

Answer 1

In WinDbg:

0:000> dt ntdll!_TEB -y ProcessEnvironmentBlock->Ldr->InM
   +0x030 ProcessEnvironmentBlock           : 
      +0x00c Ldr                               : 
         +0x014 InMemoryOrderModuleList           : _LIST_ENTRY

the list entry->Flink is a pointer to _LDR_DATA_TABLE_ENTRY-> InMemoryOrderLinks

so if you take the Flink subtract -8 and display the structure you can see it is accessing BaseDllName->Buffer (unicode string buffer ) and it MaxCount

probably uses it for parsing copying a counted widechar

0:000> ?? (ntdll!_ldr_data_table_entry *) @@masm(@@c++(@$teb->ProcessEnvironmentBlock->Ldr->InMemoryOrderModuleList.Flink)-8)
struct _LDR_DATA_TABLE_ENTRY * 0x002421b0
   +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0x242240 - 0x771c788c ]
   +0x008 InMemoryOrderLinks : _LIST_ENTRY [ 0x242248 - 0x771c7894 ]
   +0x010 InInitializationOrderLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x018 DllBase          : 0x00ef0000 Void
   +0x01c EntryPoint       : 0x00f02d6c Void
   +0x020 SizeOfImage      : 0xc0000
   +0x024 FullDllName      : _UNICODE_STRING "C:\Windows\system32\calc.exe"
   +0x02c BaseDllName      : _UNICODE_STRING "calc.exe"
   +0x034 Flags            : 0x4000
   +0x038 LoadCount        : 0xffff
   +0x03a TlsIndex         : 0
   +0x03c HashLinks        : _LIST_ENTRY [ 0x243604 - 0x771ca6a8 ]
   +0x03c SectionPointer   : 0x00243604 Void
   +0x040 CheckSum         : 0x771ca6a8
   +0x044 TimeDateStamp    : 0x4ce7979d
   +0x044 LoadedImports    : 0x4ce7979d Void
   +0x048 EntryPointActivationContext : (null) 
   +0x04c PatchInformation : (null) 
   +0x050 ForwarderLinks   : _LIST_ENTRY [ 0x242200 - 0x242200 ]
   +0x058 ServiceTagLinks  : _LIST_ENTRY [ 0x242208 - 0x242208 ]
   +0x060 StaticLinks      : _LIST_ENTRY [ 0x2454c8 - 0x243d40 ]
   +0x068 ContextInformation : 0x77160594 Void
   +0x06c OriginalBase     : 0
   +0x070 LoadTime         : _LARGE_INTEGER 0x0
0:000> dx -r1 (*((ntdll!_UNICODE_STRING *)0x2421d4))
(*((ntdll!_UNICODE_STRING *)0x2421d4))                 : "C:\Windows\system32\calc.exe" [Type: _UNICODE_STRING]
    [<Raw View>]     [Type: _UNICODE_STRING]
0:000> dx -r1 -n (*((ntdll!_UNICODE_STRING *)0x2421d4))
(*((ntdll!_UNICODE_STRING *)0x2421d4))                 : "C:\Windows\system32\calc.exe" [Type: _UNICODE_STRING]
    [+0x000] Length           : 0x38 [Type: unsigned short]
    [+0x002] MaximumLength    : 0x3a [Type: unsigned short]
    [+0x004] Buffer           : 0x242052 : 0x43 [Type: unsigned short *]