len is used in RegEnumKeyExW and this takes a character count for the 
key argument, not a byte count.

The number of remaining characters should be passed in, not the total 
buffer size.

In the case where an hdc is passed in via the wParam, ps.fErase could be 
uninitialised. Fix this by rearranging the code so that ps is only used 
when an hdc isn't passed in.

COMDLG32_SHGetFolderPathW returns a BOOL, not an HRESULT.