http://bugs.winehq.org/show_bug.cgi?id=22064
--- Comment #50 from Hans Leidekker hans@meelstraat.net 2010-08-29 09:53:01 CDT --- In my testing I have found that Windows always fills a header buffer, a data buffer and then a trailer buffer in DecryptMessage. It optionally returns another data buffer when there's more data to be decrypted than the supplied buffer can hold.
Wine currently does not do any of that, which might explain what you're seeing.