int 1
is not a part of the SEH setup, that's done by the third instruction. However, int
is intercepted by Windows and is translated into an exception which is then dispatched to the handler that has been set up by the previous instructions. So basically here it serves as a sort of "invoke handler" macro.
In practice, any privileged instruction (e.g. hlt
or out
) could have been used as well, but the "nice" thing about int 1
is that it produces a single step exception which is used by the debugging API to report single-step events to the debugger during normal debugging. If the debugger does not track its own actions properly, it may consider this exception as one originating from the debugging activity (single-stepping through the code), handle it as a normal single step and do not pass the exception to the debuggee. This means the handler code won't be executed and the debugger or tracer could be detected by the code.