Moved some individual rootkit checks into their own functions.