<i>As they say, Don&#x27;t&#x27; roll your own crypto.</i><p>I have a feeling the malware author, working in 16-bit realmode, forgot that ints are usually 16 bits wide in that environment. A &quot;typedef unsigned int uint32_t&quot; behaves as expected in the usual 32&#x2F;64-bit environment, but not in 16-bit. It&#x27;s unlikely the author invented the 16-bit Salsa20 variant, but rather copied existing code and just compiled it wrongly.