PVOID                        pKey;
PUNICODE_STRING    pUniName;
UNICODE_STRING      ustrReg;

ObReferenceObjectByHandle(KeyHandle, 0, 0, KernelMode, &pKey, NULL);
pUniName = ExAllocatePool(NonPagedPool, 1024);
ObQueryNameString(pKey, pUniName, 1024, &nRet);
    
RtlInitUnicodeString(&ustrReg, L"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
    
if (RtlCompareUnicodeString(pUniName, &ustrReg, TRUE) == 0)
{
      ExFreePool(pUniName);
      ObDereferenceObject(pKey);
    
      return STATUS_ACCESS_DENIED;
}