[NTTITON376]

You're a fucking dumb ass.

[Only3]

size of _xor_block function = (DWORD) _end < address of _end function - (DWORD) _xor_block < address of _xor_block function;

[RISC]

You don't need to disable optimisation. You can simple use the noinline attribute.

[push rcx]

Regardless if padding is applied, he's getting a negative distance, 0xffffff56

You're running this with debugging mode, therefore it's not actually pointing at a function, it's pointing at a relative JMP instruction.
To avoid this run it in release mode or by disabling incremental linking. (Be careful, when disabling incremental linking the code structure will not be aligned, you'd have to enable optimization and modify reference settings, it's alot of unnecessary setting configurations)

Code

Link Incrementally is not selected (/INCREMENTAL:NO)
/OPT:REF is selected
/OPT:ICF is selected
/OPT:LBR is selected
/ORDER is selected

For example

printing &_end in debugging mode, won't actually be the &end function, rather an address that executes a relative jmp instruction to your function.


I'd leave the incremental linking to default settings and use this function on debugging mode, possibly with some optimization:

Code

__declspec(naked) unsigned long _end()
{
    __asm
    {
        call foo
foo:
        pop eax
        sub eax, 5+_xor_block
        ret
    }
}

printf("%2X\n", _end());

[Only3]

if he need to use return then he can define it as unsigned int