My best guess.. RNG_SystemRNG first tries to use a deprecated API (http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx http://msdn.microsoft.com/en-us/

My best guess.. RNG_SystemRNG first tries to use a deprecated API (http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx http://msdn.microsoft.com/en-us/library/aa387694(VS.85).aspx), then CryptoAPI, then this temp file entropy gathering approach. But if the deprecated API is _broken_, rather than absent from the DLL, then it will fall back to scanning temp files without ever trying CryptoAPI.