Function RemoveImageNotify

KernelLibrary/SysMon.cpp:706–731

void RemoveImageNotify(_In_ PVOID context) {
	NTSTATUS status = PsRemoveLoadImageNotifyRoutine(OnImageLoadNotify);
	if (!NT_SUCCESS(status)) {
		LogError("failed to remove image load callbacks (status=%08X)\n", status);
	}
	// free the buckup dir memory
	ExFreePool(g_BackupDir.Buffer);

	// free remaining items
	while (!IsListEmpty(&g_SysMonGlobals.ItemHead)) {
		auto entry = RemoveHeadList(&g_SysMonGlobals.ItemHead);
		ExFreePool(CONTAINING_RECORD(entry, FullItem<ItemHeader>, Entry));
	}
	status = g_sec.FreeSection();
	if (!NT_SUCCESS(status)) {
		LogDebug("free section failed 0x%x\n", status);
	}
#ifdef _WIN64
	status = g_secWow.FreeSection();
	if (!NT_SUCCESS(status)) {
		LogDebug("free wow section failed 0x%x\n", status);
	}
#endif // 

	PsTerminateSystemThread(status);
}

void RemoveFilter(_In_ PVOID context) {
	NTSTATUS status = STATUS_SUCCESS;