During an analysis, I have found a call to
ZwContinue. The executable file first gets the address of
ntdll.NtContinue and stores it in the EAX register.
After I step over the following assembly line,
CALL EAX ; ntdll.ZwContinue
then OllyDbg (v1.10) terminates the process.
I have found out that this is a kind of anti-debugging mechanism but I could not figure out how to defeat it.
Is there any plugin which I can use or any other helpful trick?