Interestingly the malware appears to first checks to make sure the received command is for the actual host - via a call to a function named check_if_targeted. This function extracts values received from the server checking that