1. At least one non-transitory computer-readable medium comprising one or more instructions that, when executed by a processor, perform a method comprising: receiving a function call from a security program, wherein the function call is an asynchronous procedure call; determining a return address for the function call on an operating system stack above an address of the function call; and pushing parameters on the operating system stack for a call for a dynamic link library to lead an operating system kernel back to restore a routine, if the return address does not belong to a trusted module.