See
Registry Key Security and Access Rights
You can specify a security descriptor for a registry key when you call the
RegCreateKeyEx or
RegSetKeySecurity function. If you specify NULL, the key gets a default security descriptor. The ACLs in a default security descriptor for a key are inherited from its direct parent key.
To get the security descriptor of a registry key, call the GetNamedSecurityInfo or GetSecurityInfo function.
Delphi translation of RegSetSecurity can be found in the
unit JwaWinReg.pas from the
Jedi Api Lib