The CryptGenRandomBytes uses whatever data is already in the buffer as 
seed for the output.  So, the buffer is effectively an in/out buffer.  
Now, since we are generating random data anyway, the fact that we are 
using an undefined seed for the data shouldn't matter.  However, this 
does create a bunch of false positives for analysis tools such as 
Purify, that track the copying and usage of uninitialized data.
An easy patch is to clear the buffer before submitting it to 
CryptGenRandomBytes, and is attached.