Engine EndScene Hook CrossFire NA UNDETECTED

#include "drawing.h"
#include <process.h>
using namespace std;

DWORD dw_GoBack, dw_DeviceGame, dw_RetnAddress;
static LPDIRECT3DDEVICE9 lpd_Device;

void PlaceJMP(BYTE *bt_DetourAddress, DWORD dw_FunctionAddress, DWORD dw_Size)
{
	DWORD dw_OldProtection, dw_Distance;
	if (dw_Size < 5) VirtualProtect(bt_DetourAddress, 5, PAGE_EXECUTE_READWRITE, &dw_OldProtection);
	else VirtualProtect(bt_DetourAddress, dw_Size, PAGE_EXECUTE_READWRITE, &dw_OldProtection);
	dw_Distance = (DWORD)(dw_FunctionAddress - (DWORD)bt_DetourAddress) - 5;
	*bt_DetourAddress = 0xE9;
	*(DWORD*)(bt_DetourAddress + 0x1) = dw_Distance;
	for(int i = 0x5; i < dw_Size; i++) *(bt_DetourAddress + i) = 0x90;
    return;
}

bool bCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(;*szMask;++szMask,++pData,++bMask)
	if(*szMask=='x' && *pData!=*bMask)   return 0;
	return (*szMask) == NULL;
}

DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
	for(DWORD i=0; i<dwLen; i++)
	if (bCompare((BYTE*)(dwAddress+i),bMask,szMask))  return (DWORD)(dwAddress+i);
	return 0;
}

__declspec(naked)HRESULT WINAPI ESHook()
{	
	__asm 
	{
		PUSH EDX
		MOV EDX, DWORD PTR SS:[EBP + 4]
		MOV dw_RetnAddress, EDX
		POP EDX
		PUSHAD
	}

	if (dw_RetnAddress == 0x450B30)
	{
		if(!dw_DeviceGame)
		{
			dw_DeviceGame = FindPattern(0x400000, 0xFFFFFF,(unsigned char*)"\x8B\x35\xFF\xFF\xFF\xFF\x8B\xEE\xE8\xFF\xFF\xFF\xFF\x8B\x45\x00\x8B\x08\x8B\x91\xFF\xFF\xFF\xFF\x57\x6A\xFF\x53","xx????xxx????xxxxxxx????xx?x");
			lpd_Device = *(LPDIRECT3DDEVICE9 *)(*(DWORD *)(*(DWORD *)(dw_DeviceGame + 2)));
		}	
		else
		{
			//do your stuff here
		}
	}

	__asm 
	{
		POPAD
		MOV DWORD PTR SS:[EBP-4], ECX
		MOV EAX, DWORD PTR SS:[EBP-4]
		JMP dw_GoBack
	}
}

void Starter(void *)
{
	while (true)
	{
		if (*(BYTE*)(0x4181C4) != 0xE9)
		{
			PlaceJMP ((PBYTE)(0x4181C4), (DWORD)ESHook, 6);
			dw_GoBack = 0x4181CA;
		}
	}
}

BOOL APIENTRY DllMain(HMODULE hDll,DWORD dwReason,LPVOID lpReserved)
{
	switch (dwReason)
	{
		case DLL_PROCESS_ATTACH:
		{	
			DisableThreadLibraryCalls (hDll);
			_beginthread (Starter, 0, 0);
		}
		case DLL_THREAD_ATTACH: break;
		case DLL_THREAD_DETACH: break;
		case DLL_PROCESS_DETACH: break;
	}
	return TRUE;
}

---------------------------
Themida
---------------------------
An internal exception occured (Address: 0x6f8a7a)

Please, contact support@oreans.com. Thank you!
---------------------------
OK   
---------------------------

void Starter(void *)
{
	while (true)
	{
		 if( memcmp( ( VOID * )(0x4181C4), ( VOID * )( PBYTE )"\x89\x4D", 2 ) == 0 )// binary string "89 4D FC 8B 45 FC 8B 4D 08 89 08 8B 4D 08"
		{
			DetourCreate((PBYTE)(0x4181C4), (PBYTE)ESHook, 6);
			dw_GoBack = (0x4181C4+0x6); //(+6)
		}
		 Sleep(50);
	}
}

if (dw_RetnAddress == 0x450B30)//Binary String "33 C9 89 4C 24 14 38 0D ?? ?? ?? ?? 74 ?? A1 ?? ?? ?? ?? 3B C1 "