If it weren't for the "fastcall" convention using ECX for an actual argument value, they could have used "MOV ECX,EDI" and then the change to a "JMP $-5" would have been possible with a single byte store to the opcode (0x89 -> 0xeb), removing any worries about a two-byte store straddling a cache-line or page boundary.