add the function name to the unhook anomaly log entry
detect the type of unhooking