[Статья] "Поиск инжектов" или "Наш код в чужом процессе"

[Adrev]

Взял код таргета внес его в функцию взятую в соседней теме, в итоге вылет клиента. Вот код:

static DWORD WINAPI SelectMonster(LPCVOID lpParam)
{
	DWORD BaseAddress= 0xCCEFAC;
	DWORD CallAddress=0xCCF74C;
	DWORD MonsterID = (DWORD)2148532360;
	__try
	{
		_asm
		{
		MOV EDI, MonsterID; // Вносим WID моба в регистр EDI
		MOV EBX, 0x00746BD0; //Call Targeta
		MOV EAX,DWORD PTR DS:[0xCCEFAC];
		PUSH EDI ;
		MOV ECX,DWORD PTR DS:[EAX+0x20] ;
		ADD ECX,0x0F4;
		CALL EBX;
		}
	}
	__except(1)
	{
	}
	return 0;
}
//---------------------------------------------------------------------------
bool CallRemoteFunction(int ProcessId)
{
	//Remote Thread Handle
	HANDLE hProcess1=NULL;
	//Inject Thread handle
	HANDLE hThread=NULL;
	//Inject Fuction Address after allocate
	LPVOID ThreadCodeAddr=NULL;
	//Inject Function
	LPVOID Func=SelectMonster;
	//Inject Fuction Stack Address after allocate
	LPVOID ThreadDataAddr=NULL;
	//Inject Fuction Stack Data
	LPCVOID lpParam = NULL;
	DWORD Value = 0;
	lpParam = &Value;

	hProcess1 = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);
	if (!hProcess1)
	{
		//Do your Error message (OpenProcess);
		return false;
	}
	ThreadCodeAddr=VirtualAllocEx(hProcess1, NULL, 4096, MEM_COMMIT, PAGE_READWRITE);
	ThreadDataAddr=VirtualAllocEx(hProcess1, NULL, 256, MEM_COMMIT, PAGE_READWRITE);
	WriteProcessMemory (hProcess1, ThreadCodeAddr, Func, 4096, NULL);
	WriteProcessMemory (hProcess1, ThreadDataAddr, lpParam, 256, NULL);
	hThread = CreateRemoteThread(hProcess1, NULL, NULL,(LPTHREAD_START_ROUTINE)ThreadCodeAddr, ThreadDataAddr, NULL, NULL);
	if (!hThread)
	 {
		//Do your Error message (CreateRemoteThread);
	 }
	else
		WaitForSingleObject(hThread, INFINITE);
	CloseHandle(hThread);
	VirtualFreeEx(hProcess1, ThreadCodeAddr, 4096, MEM_RELEASE);
	VirtualFreeEx(hProcess1, ThreadDataAddr, 256, MEM_RELEASE);
	CloseHandle(hProcess1);
	return false;
}
//---------------------------------------------------------------------------



void __fastcall TForm1::sButton2Click(TObject *Sender)
{
CallRemoteFunction(ProcessId);
}

В чём ошибка?