After the beginning of the first while loop, the backdoor registers itself at the C2 server. It is going through the list of C2 servers stored in its registry configuration parameter until it finds one responding. The hosts are stored in the aforementioned "Hosts" registry key in the format &lt;IP Address Host1&gt; &lt;TcpPort&gt; &lt;IP Address Host2&gt; &lt;TcpPort&gt; &lt;IP Address Host3&gt; &lt;TcpPort&gt;, etc