NTSTATUS
RtlpNtQueryValueKey(
  IN  HANDLE KeyHandle,
  OUT OPTIONAL PULONG KeyValueType,
  OUT OPTIONAL PVOID KeyValue,
  IN OUT OPTIONAL PULONG KeyValueLength,
  OUT OPTIONAL PLARGE_INTEGER LastWriteTime
  );

Routine Description:

    This function queries the value of a key.

Arguments:

    KeyHandle - Handle of a key opened for GENERIC_READ access via NtOpenKey.

    KeyValueType - Optional pointer to variable that will receive the
        client-defined type of the key value (if any).  If no value has been
        set for the key, 0 is returned.

    KeyValue - Optional pointer to buffer in which part or all of the key's
        value (as set on the most recent call to NtSetValueKey) will be
        returned.  If the key's value is too large to fit into the supplied
        buffer, as much of the value as will fit into the buffer will be
        returned and the warning STATUS_BUFFER_OVERFLOW is returned.  If no
        value has ever been set, nothing is returned.  If NULL is specified
        for this parameter, no Key Value is returned.

    KeyValueLength - On input, this optional parameter points to a variable
        that contains the length in bytes of the KeyValue buffer (if any).  If
        no KeyValue buffer is specified, the variable content on entry is
        ignored.  On return, the referenced variable (if any) receives the
        FULL length in bytes of the key value.  If the key's value is too
        large to fit into the supplied buffer, as much of the value as will
        fit into the buffer will be returned and the warning
        STATUS_BUFFER_OVERFLOW is returned.

        The returned length is intended for use by calling code in allocating
        a buffer of sufficient size to hold the key's value.  After receiving
        STATUS_BUFFER_OVERFLOW from NtQueryValueKey, calling code may make a
        subsequent call to NtQueryValueKey with a buffer of size equal to the
        length returned by the prior call.

        If no value has been set for the key, 0 is returned.

    LastWriteTime - Optional parameter to variable which receives a time stamp
        specifying the last time that the key was written.

Return Value:

    NTSTATUS - Result code

        STATUS_SUCCESS - Call was successful

        STATUS_INVALID_PARAMETER - Invalid parameter

        STATUS_ACCESS_DENIED - Caller does not have GENERIC_READ access to
            the specified key

        STATUS_BUFFER_OVERFLOW - This is a warning that the key's value
            is too large for the buffer specified by the KeyValue and
            KeyValueLength parameters.  Use the length returned to
            determine the size of buffer to allocate for a subsequent
            call of NtQueryValueKey.