struct SGame
{
	HWND hWnd;
	HANDLE hProcess;	
	LPVOID pAllocMemory;
	DWORD dwProcessID;
};
SGame Game;

LPCTSTR lpCaption = "Message";
LPCTSTR lpText = "Hello";

void InjectThread()
{
	FARPROC Message = GetProcAddress(GetModuleHandle( TEXT("user32.dll")), "MessageBox");
	_asm
	{
		push 0
		push lpCaption
		push lpText
		push 0
		call dword ptr [Message]
	}
}
static void after_InjectThread()
{

}
int main()
{
	if(!(Game.hWnd = FindWindow(NULL, "iTunes")))
		printf("[-] FindWindow failed! Error: %d\n", GetLastError());
	else 
		printf("[+] FindWindow succesfully\n");

	GetWindowThreadProcessId(Game.hWnd,&Game.dwProcessID);
	if(!(Game.hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, Game.dwProcessID)))
		printf("[-] OpenProcess failed! Error: %d\n", GetLastError());
	else 
        printf("[+] OpenProcess succesfully\n");

	DWORD sizeOfFunc = (PBYTE)&after_InjectThread - (PBYTE)&InjectThread;
	printf("[+] Size of Function: %d\n", sizeOfFunc);
	
	if(!(Game.pAllocMemory = VirtualAllocEx(Game.hProcess, 0, sizeOfFunc, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE)))
		printf("[-] VirtualAllocEx failed! Error: %d\n", GetLastError());
	else 
	{
		printf("[+] VirtualAllocEx succesfully\n!");
		if(!WriteProcessMemory(Game.hProcess, Game.pAllocMemory, &InjectThread,  sizeOfFunc, 0))
			printf("[-] WriteProcessMemory failed! Error: %d\n", GetLastError());
		else
		{
			printf("[+] WriteProcessMemory succesfully\n");
			if(!CreateRemoteThread(Game.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)Game.pAllocMemory, NULL, NULL, NULL))
				printf("[-] CreateRemoteThread failed! Error: %d\n", GetLastError());
			else printf("[+] CreateRemoteThread succesfully\n");
		}
	}
	CloseHandle(Game.hProcess);

	while(true)
	{

		Sleep(100);
	}
	return 0;
}

0040ff90 mov eax,1234

Kurzer Peseudcode(naja eigentlich ist der gar nicht so Pseudo^^):
unsigend LongJmpOpcode = 0xe9;
unsigned JumpFromThisAddr = 0040ff90;

WriteProcessMemory(handle, (void*)JumpFromThisAddr, &LongJmpOpcode, 1, 0 );
        
unsigned TargerAddrOpcodes = BerechneSprungAdresse(  AdressOfReserveMemoryArea, JumpFromThisAddr);

JumpFromThisAddr++;  // Du willst ja nicht deinen JMP Long Opcode überschreiben

WriteProcessMemory(handle, (void*)JumpFromThisAddr, &LongJmpOpcode, OpcodeLength, 0 );  // OpcodeLength = 4

Hier noch:

JumpFromThisAddr+=4;
unsigned nop = 0x90;  // NOP operation
WriteProcessMemory(handle,(void*)CallFromThisAddr, &nop, 1, 0 );

Damit dein JMP die richtige Opcode Länge bekommt.

unsigned BerechneSprungAdresse( unsigned AdressOfReserveMemoryArea, unsigned JumpFromThisAddr)
{
return ZielAdressOpcodes = (AdressOfReserveMemoryArea - JumpFromThisAddr)  - 5;
}