Weird looking assembly-code bunch

Question

I am currently analysing some crackme with Olly and IDA. Initially it was packed. I managed to find the OEP (a JMP soon after POPAD and right before a bunch of nulls):

0040E978    .  53                    PUSH    EBX
0040E979    .  57                    PUSH    EDI
0040E97A    .  FFD5                  CALL    NEAR EBP
0040E97C    .  58                    POP     EAX
0040E97D    .  61                    POPAD
0040E97E    .  8D4424 80             LEA     EAX, DWORD PTR SS:[ESP-80]
0040E982    >  6A 00                 PUSH    0
0040E984    .  39C4                  CMP     ESP, EAX
0040E986    .^ 75 FA                 JNZ     SHORT crackme_.0040E982
0040E988    .  83EC 80               SUB     ESP, -80
0040E98B    .- E9 7062FFFF           JMP     crackme_.00404C00
0040E990       00                    DB      00
0040E991       00                    DB      00
0040E992       00                    DB      00

But I might have done something incorrectly or, may be, it's some sort of obfuscation technique, cause the unpacked program is full of something like that:

                lea     ecx, ds:2186C225h ; Load Effective Address
UPX0:00403042   mov     ebx, 0C11A8EBBh
UPX0:00403047   lea     ebx, [ebx-6CFE17B8h] ; Load Effective Address
UPX0:0040304D   add     ecx, ecx        ; Add
UPX0:0040304F   lea     ebx, [eax-68FB1E76h] ; Load Effective Address
UPX0:00403055   sub     ecx, eax        ; Integer Subtraction
UPX0:00403057   lea     eax, [ebp-6Ch]  ; Load Effective Address
UPX0:0040305A   push    eax
UPX0:0040305B   call    $+5             ; Call Procedure
UPX0:0040305B   
UPX0:00403060   pop     eax
UPX0:00403061   add     eax, 0Ah        ; Add
UPX0:00403064   push    eax
UPX0:00403065   jmp     loc_408EF0      ; Jump

What confuses me most (other than UPX prefix, although it seems to be unpacked), are instructions like these:

UPX0:00403047   lea     ebx, [ebx-6CFE17B8h] ; Load Effective Address   
UPX0:0040304F   lea     ebx, [eax-68FB1E76h] ; Load Effective Address

Moreover, throughout the code there are lots of call-jumps, that point to the next instruction, rather than somewhere else in the code (which is much more common):

0040327B     50                      PUSH    EAX
0040327C     E8 00000000             CALL    crackme2.00403281
00403281     58                      POP     EAX
...
0040321A     50                      PUSH    EAX
0040321B     8B45 08                 MOV     EAX, DWORD PTR SS:[EBP+8]
0040321E     50                      PUSH    EAX
0040321F     E8 00000000             CALL    crackme2.00403224
00403224     58                      POP     EAX

How common is that?

I thought, that may be I did the unpacking wrongly, but the program seems to work properly. My next though was that it might be self-modifying, but when I put BP on GetWindowTextA, where first, last names and serial are loaded, and then go through the code, it doesn't seem to be changing.

Is it possible, that there are addresses like this?:

lea     ecx, ds:2186C225h ; Load Effective Address
...
lea     ebx, [eax-68FB1E76h] ; Load Effective Address

Or may be there is something wrong with the OllyDbg's interpretation of the code?

Thank you in advance!

Answer 1

If you follow the flow, you will see that the result of the first "lea ebx, []" is replaced by the result of the "lea ebx, []", with no intervening use of ebx. While they can serve a meaningful purpose (consider position-independent code), that's not their use here. These are garbage instructions that exist only to confuse someone looking at the disassembly.

As far as the call to the next instruction, the call saves on the stack the pointer to the return address, so popping that value into a register will allow the code to know its location in memory. That can be for the purpose of position-independent code, or just a way to avoid using constants to make the disassembly more difficult.