For any program to handle exceptions, Windows provides a mechanism called SEH. It's based on setting a callback function to handle the exception and then resume execution. If this callback failed to handle the exception, it can pass this exception to the previous callback that was set. If the last callback was unable to handle the exception, the operating system terminates the process and informs the user about the unhandled exception, and often suggests him or her to send it to the developer company.
A pointer to the first callback to be called is stored in the thread information block (TIB) and can be accessed via FS:[0x00]. The structure is a linked list, which means that each item in this list contains the address of the callback function and follows the address of the previous item in the list (the previous callback). The linked list looks like this in the stack:
The setup of the SEH callback generally...