TL;DR: You should place a breakpoint at the address passed as the single parameter to setunhandledexceptionfilter
and ignore the exception / pass the exception to the program.
A more detailed explanation
Here you can see the documentation for setunhandledexceptionfilter
, reading it if you didn't already might make things clearer for you.
To make sure that user supplied function is called (see background for why) you should pass the exception to the program using olly. However, when you'll do that, the rest of the malware's code will execute from within the unhandled exception function and you'll lose control of the debugged program. To make sure you're still controlling the execution flow, you should place a breakpoint at the function passed as an argument to setunhandledexceptionfilter
.
Some context and background
setunhandledexceptionfilter
is used to set a user provided function as the function called when exception was not handled by any exception handler, just before the process is terminated. That function should be in charge of object cleanups and clean termination in the case of an unhandled exception.
There are several ways to use setunhandledexceptionfilter
as an anti-debugging trick, but most will involve implementing a crucial part of the program inside the new unhandled exception handler, and then resume the rest of the code execution from within the exception handler.