Function at 0x401f48
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], rcx
mov eax, edx
mov edx, r8d
mov byte [rbp + 0x148], al
mov byte [rbp + 0x150], dl
mov dword [rbp + 0x12c], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x120], rax
mov eax, 0x130
mov dword [rbp - 0x50], eax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x120]
mov rcx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x401ff9
jmp 0x401fdd
lea rax, [rbp - 0x50]
add rax, 0x2c
lea rdx, str.Meridian.exe
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x401fdd
mov eax, dword [rbp - 0x48]
mov dword [rbp + 0x12c], eax
nop
jmp 0x401ff9
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x120]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x401fb6
mov rax, qword [rbp + 0x120]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rbp + 0x11c], 0x1f0fff
mov edx, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x11c]
mov r8d, edx
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x110], rax
lea rdx, [rbp + 0xf3]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8, rdx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x402095
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x402243
movzx edx, byte [rbp + 0xf3]
movzx eax, byte [rbp + 0x148]
cmp dl, al
jne 0x40217b
mov qword [rbp + 0x108], 1
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
mov rcx, qword [rbp + 0x108]
lea rdx, [rbp + 0x150]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, rdx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0x104], eax
mov r8d, dword [rbp + 0xec]
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, r8d
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
cmp dword [rbp + 0x104], 0
je 0x402176
mov eax, 0
jmp 0x402243
jmp 0x402243
mov qword [rbp + 0xf8], 1
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
mov rcx, qword [rbp + 0xf8]
lea rdx, [rbp + 0x148]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, rdx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0xf4], eax
mov r8d, dword [rbp + 0xec]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, r8d
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
cmp dword [rbp + 0xf4], 0
je 0x402243
mov eax, 0
jmp 0x402243
add rsp, 0x1b0
pop rbp
ret