                                                                ;proc DllMainCRTStartup uses ebx esi edi, hinstDLL,fdwReason,lpReserved
                                                                include 'win32w.inc'
                                                                use32
                                                                
                                                                macro movediedisig
                                                                {
                                                                  dw 0FF8Bh
                                                                }
                                                                
                                                                  label DllMain:dword at 5C281E0Eh
                                                                  label CRT_INIT:dword at 5C283C91h
                                                                  label pRawDllMain:dword at 5C28568Ch
                                                                
                                                                org 5C283D46h
                                                                
                                                                DllMainCRTStartup:
                                                                virtual at ebp
                                                                  old_ebp    dd ?
                                                                  ret_addr   dd ?
                                                                  hinstDLL   dd ?
                                                                  fdwReason  dd ?
                                                                  lpReserved dd ?
                                                                end virtual
                                                                
00000000: 8B FF                                                 	movediedisig
00000002: 60                                                    	pushad
00000003: 8B 5D 08                                              	mov	ebx, [hinstDLL]
00000006: 8B 45 0C                                              	mov	eax, [fdwReason]
00000009: 8B 7D 10                                              	mov	edi, [lpReserved]
                                                                ;***preserve callstack
0000000C: 57 50 53                                              	push	edi eax ebx
                                                                ;***preserve callstack
0000000F: 31 D2                                                 	xor	edx,edx
00000011: 8D 4A 03                                              	lea	ecx,[edx+3]
00000014: F7 F1                                                 	div	ecx
00000016: 85 D2                                                 	test	edx,edx
00000018: 75 39                                                 	jnz	.ATTACH_CASE
                                                                    .DETACH_CASE:
0000001A: 85 C0                                                 	test	eax,eax
0000001C: 75 0E                                                 	jnz	@F
                                                                    ;DETACH_PROC_ONLY PART:
0000001E: 83 3D 1C 56 28 5C 00                                  	cmp	dword [5C28561Ch], 0
00000025: 75 05                                                 	jnz	@F
00000027: 83 C4 0C                                              	add	esp,0Ch ; not required callstack
0000002A: EB 5F                                                 	jmp	.locret
                                                                    ;END ONLY
                                                                    @@:
0000002C: E8 97 E0 FF FF                                        	call	DllMain ; params from stack
00000031: 89 C6                                                 	mov	esi,eax
00000033: 83 EC 0C                                              	sub	esp,0Ch  ;with same params as previous call
00000036: E8 10 FF FF FF                                        	call	CRT_INIT ; params from stack
0000003B: 21 F0                                                 	and	eax,esi
0000003D: 74 4C                                                 	jz	.locret
0000003F: 83 3D 8C 56 28 5C 00                                  	cmp	[pRawDllMain],0
00000046: 74 43                                                 	jz	.locret
00000048: 83 EC 0C                                              	sub	esp,0Ch  ;with same params as previous call
0000004B: FF 15 8C 56 28 5C                                     	call	[pRawDllMain]
00000051: EB 38                                                 	jmp	.locret
                                                                    ;DETACH_CASE END
                                                                    .ATTACH_CASE:
00000053: 83 3D 8C 56 28 5C 00                                  	cmp	[pRawDllMain],0
0000005A: 74 0D                                                 	jz	@F
0000005C: FF 15 8C 56 28 5C                                     	call	[pRawDllMain]
00000062: 85 C0                                                 	test	eax,eax
00000064: 74 25                                                 	jz	.locret
00000066: 83 EC 0C                                              	sub	esp,0Ch
                                                                    @@:
00000069: E8 DD FE FF FF                                        	call	CRT_INIT
0000006E: 85 C0                                                 	test	eax,eax
00000070: 74 19                                                 	jz	.locret
00000072: 83 EC 0C                                              	sub	esp,0Ch  ;with same params as previous call
00000075: E8 4E E0 FF FF                                        	call	DllMain
0000007A: 83 FA 01                                              	cmp	edx,DLL_PROCESS_ATTACH
0000007D: 75 0C                                                 	jnz	.locret
                                                                    ;ATTACH_PROC_ONLY PART:
0000007F: 85 C0                                                 	test	eax,eax
00000081: 75 08                                                 	jnz	.locret
00000083: 57 50 53 E8 C0 FE FF FF                               	stdcall CRT_INIT,ebx,eax,edi
                                                                    ;END ONLY
                                                                    ;ATTACH_CASE END
                                                                    .locret:
0000008B: 61                                                    	popad
0000008C: C2 0C 00                                              	retn	0Ch
                                                                


5C283D46  8B FF 60 8B 5D 08 8B 45  0C 8B 7D 10 57 50 53 31
5C283D56  D2 8D 4A 03 F7 F1 85 D2  75 39 85 C0 75 0E 83 3D
5C283D66  1C 56 28 5C 00 75 05 83  C4 0C EB 5F E8 97 E0 FF
5C283D76  FF 89 C6 83 EC 0C E8 10  FF FF FF 21 F0 74 4C 83
5C283D86  3D 8C 56 28 5C 00 74 43  83 EC 0C FF 15 8C 56 28
5C283D96  5C EB 38 83 3D 8C 56 28  5C 00 74 0D FF 15 8C 56
5C283DA6  28 5C 85 C0 74 25 83 EC  0C E8 DD FE FF FF 85 C0
5C283DB6  74 19 83 EC 0C E8 4E E0  FF FF 83 FA 01 75 0C 85
5C283DC6  C0 75 08 57 50 53 E8 C0  FE FF FF 61 C2 0C 00 CC
5C283DD6  CC CC CC CC CC CC CC CC  CC CC CC CC CC CC CC CC