http://bugs.winehq.org/show_bug.cgi?id=22064
--- Comment #66 from Mikko Rasa tdb@tdb.fi 2010-08-30 11:49:37 CDT --- I changed my test program to feed in the data in the last buffer, and this is what I got back:
Decrypted buffer 0 (5 bytes @003E60B5, type 1): 00 00 00 00 30 Decrypted buffer 1 (16 bytes @003E60BA, type 6): cd 91 b4 75 83 57 55 f3 ba cf a1 ec b1 be ad 5c Decrypted buffer 2 (0 bytes @00000000, type 0): Decrypted buffer 3 (5 bytes @003E60B0, type 7): 17 03 01 00 15
It's definitely using the original data buffer as header and the first two empty buffers for data and trailer.