Accomplished by manually removing #define HAVE_BCRYPT_H 1 from config.h and rebuilding using MSVC/Visual Studio IDE. Try as I might I couldn't get the CMakeLists.txt changes (e.g. setting ENABLE_CNG to OFF) to take effect, but this seems to have worked.

Why? Because Windows XP didn't include bcrypt.dll (a Microsoft DLL) and we don't really need it as we don't support password-protected ZIP files anyway. <shrug>