Link function calls against reverse engineered binary

Question

I created an windows x86 .exe file that I reverse engineer. Imagine I only have the .exe file and I reverse engineered some functions.

The goal is to create a dll that links with this .exe so the dll can call functions of the .exe, let's say the function defined at address 0x401000, let's call it foo. The dll is in the same process memory as the .exe of course (dll hijacking strategy).

Is it possible to code using c or c++ such that the assembly of the dll will call foo using call 0x401000? But then of course relocated such that the relative call is correct.

What I have tried so far is defining const function pointers in C, but that always seems to lead to assembly that does two steps, e.g. call dword ptr [pointer variable] or mov ecx, 0x401000; call ecx. What I would like to see is that machine code instruction 0xE8 is used.

See this example:

// For the result, see https://godbolt.org/z/T6aabn6Wd
void (* const foo)(int b, int c) = (void (* const)(int b, int c)) 0x401000;

#pragma optimize("",off)
int bar(int a, int b) {
    return a * b;
}
#pragma optimize("",on)

int main(int argc, char**argv) {
    int ba = bar(100, 200);
    foo(100, ba);
    return 0;
}

I also tried doing it using inline assembly in a __asm {call foo } block, but that leads to FF 15 00 00 00 00 and not to E8 00 00 00 00.

If I understand the PE file format correctly then a relocation table should make it possible to use E8 since the address location of the .exe is known (assuming image base address 0x400000), but the dll location in virtual memory is unknown at compile time.

Should I generate a custom .obj or .lib based on the .exe? As far as I know a .lib can only be used if the binary actually exports the function, which an .exe file doesn't.