[leecher]

Another thing that would be interesting is if you try the following adjustments:

NTSTATUS OpenKey(HANDLE* pkey, HANDLE root, PWSTR name)
{
	UNICODE_STRING usKey;
	RtlInitUnicodeString(&usKey, name);
	attr.RootDirectory = root;
	attr.ObjectName = &usKey;
	return ZwOpenKey(pkey, KEY_READ, &attr);
}

So, using KEY_READ instead of KEY_ENUMERATE_SUB_KEYS|KEY_QUERY_VALUE, because that also includes STANDARD_RIGHTS_READ.
If it doesn't work, this can also be tried:

NTSTATUS OpenKey(HANDLE* pkey, HANDLE root, PWSTR name)
{
	OBJECT_ATTRIBUTES objectAttributes;
	UNICODE_STRING usKey;
	RtlInitUnicodeString(&usKey, name);
	InitializeObjectAttributes( &objectAttributes,
                                &usKey,
                                OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
                                root,
                                (PSECURITY_DESCRIPTOR) NULL
                                );
	return ZwOpenKey(pkey, KEY_READ, &objectAttributes);
}

Maybe this helps when reading the key? Just guessing.