Even a poorly-implemented homebrew encryption function would have been better than using a broken implementation of a common, trivially-recognizable function.  It was easy for them to run this code through an SMT solver because it was easy to obtain the original source code.<p>It would have been smarter to bundle the ransomware with a 32-bit DOS extender so the known-good Salsa implementation could be used unchanged.