You are passing the address of a
value as output buffer and the address
as pointer to the size parameter. But
requires the address of a buffer that can hold the data specified by the
parameter which must be passed as address of a
to receive the data length read from the registry.
So you have an access violation and a buffer overrun.
A workin code would look like:
DWORD dwSize = MAX_PATH;
RegQueryvalueEx(hKey, "", NULL, NULL, LPBYTE(lpszBuffer), &dwSize);