That doesn't necessarily mean that rsaenh loads bcrypt. The test calls advapi32 functions like CryptAcquireContext() which will in turn load an appropriate provider dll, such as rsaenh. Just a call to RegCreateKey() is sufficient to load bcrypt, so it's possible that advapi32 or one of its dependencies imports bcrypt.