What DllMain Sees

// Inside evil.dll -- runs in the TARGET process context
BOOL APIENTRY DllMain(HMODULE h, DWORD reason, LPVOID res) {
    switch (reason) {
    case DLL_PROCESS_ATTACH:
        DisableThreadLibraryCalls(h);   // reduce noise
        // payload: hook APIs, patch a string, exfil data...
        MessageBoxA(NULL, "injected!", "evil.dll", MB_OK);
        break;
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

• DLL_PROCESS_ATTACH fires when the DLL is loaded — this is the entry point for the payload.
• Heavy work in DllMain is risky (loader lock); real malware often just spawns a worker thread here.