NtUnloadKey - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTREGAPI_H

/**
 * Unloads a registry key.
 * 
 * @param TargetKey Pointer to the object attributes of the target key.
 * @return NTSTATUS Successful or errant status.
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtUnloadKey(
    _In_ POBJECT_ATTRIBUTES TargetKey
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwUnloadKey(
    _In_ POBJECT_ATTRIBUTES TargetKey
    );

#endif

View code on GitHub

Function NtUnloadKey unloads previously loaded Hive file from registry structure. All changes made to keys and values under this Hive are stored.

DestinationKeyName

Pointer to OBJECT_ATTRIBUTES structure contains path and name of Hive root key.

Documented by

Requirements

Privilege: SE_RESTORE_PRIVILEGE

See also

Edit description on GitHub