Professional Rootkits (Programmer to Programmer)

This function is called by OnUnload when the rootkit is being unloaded. The insertion of a registered completion routine increases the difficulty of this operation. A registered completion routine must be completed or canceled before the rootkit is unloaded to prevent the possibility of a system crash.