D3D9 EndScene Hook - Crash

[th0rex]

Hello guys.

Yesterday I started working on a d3d Menu for Cubeworld. I already had one and I just wanted to make a new one which is good written to improve my skills. But it always crashes and I have no idea why. The original function is fine and at a valid adress and it hooks the right function. Maybe I overlook something totally obvious. I hope you can help me. At the moment my hook does nothing more than just call the original function and it does not work.

 Spoiler

LPDIRECT3DDEVICE9 g_pDevice = nullptr;
typedef HRESULT(WINAPI* EndScene_t)(LPDIRECT3DDEVICE9 pDevice);
EndScene_t pEndScene = 0;
HRESULT __stdcall hkEndScene(LPDIRECT3DDEVICE9);

void __stdcall initHooks()
{
	HMODULE hModule = NULL;
	while (!hModule)
	{
		hModule = GetModuleHandleA("d3d9.dll");
		Sleep(100);
	}
	DWORD* VTableStart = 0;
	DWORD dwVTablePattern = dwFindPattern((DWORD)hModule, 0x128000,
		(PBYTE)"\xC7\x06\x00\x00\x00\x00\x89\x86\x00\x00\x00\x00\x89\x86", "xx????xx????xx");
	memcpy(&VTableStart, (void*)(dwVTablePattern + 2), 4);
	DWORD dwEndScene =	(DWORD)VTableStart[42];
	std::cout << "dwEnddscene: 0x" << std::setw(8) << std::setfill('0') << std::setbase(16) << dwEndScene << std::endl;
	pEndScene = (EndScene_t)DetourFunc((PBYTE)dwEndScene, (PBYTE)hkEndScene, 5);
}

HRESULT __stdcall hkEndScene(LPDIRECT3DDEVICE9 pDevice)
{
	return pEndScene(pDevice);
}

BOOL WINAPI DllMain(
	_In_  HINSTANCE hinstDLL,
	_In_  DWORD fdwReason,
	_In_  LPVOID lpvReserved
	)
{
	switch (fdwReason)
	{
	case DLL_PROCESS_ATTACH:
		CreateThread(0, 0, (LPTHREAD_START_ROUTINE)&initHooks, 0, 0, 0);
		break;
	}

		return TRUE;
}

Edit:
Heres the code at endscene and at pEndScene.

 Spoiler

// At the start of the endscene function 
d3d9.Direct3DCreate9Ex+15ACA - E9 4CEECEED           - jmp CubeWorldHack.hkEndScene

// My function
CubeWorldHack.hkEndScene - 55                    - push ebp
CubeWorldHack.hkEndScene+1- 8B EC                 - mov ebp,esp
CubeWorldHack.hkEndScene+3- 5D                    - pop ebp
CubeWorldHack.hkEndScene+4- FF 25 10549E5B        - jmp dword ptr [CubeWorldHack.pEndScene]

// Code at pEndScene (first 3 lines were overwritten by the jmp to my hook)
109675D0 - 8B FF                 - mov edi,edi // here it crashes.
109675D2 - 55                    - push ebp
109675D3 - 8B EC                 - mov ebp,esp
109675D5 - E9 CAB1385D           - jmp d3d9.Direct3DCreate9Ex+15ACF

Edit 2:
Well I have no idea why but i fixxed it. I did not recreate the original 5 bytes i overwrote and now it works. Could someone explain to me why it works even tho the bytes miss in the hook ?