I called a game function

I managed to call an internal game function directly from injected code. With a disassembler I found the function address, figured out the calling convention and the parameter layout, then called it from my DLL. That basically gives you full control over the internal game logic. Thanks to Guided Hacking for the tutorials that helped me.