Function at 0x401c41
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], rcx
mov eax, edx
mov edx, r8d
mov word [rbp + 0x148], ax
mov word [rbp + 0x150], dx
mov dword [rbp + 0x12c], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x120], rax
mov eax, 0x130
mov dword [rbp - 0x50], eax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x120]
mov rcx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x401cf4
jmp 0x401cd8
lea rax, [rbp - 0x50]
add rax, 0x2c
lea rdx, str.Meridian.exe
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x401cd8
mov eax, dword [rbp - 0x48]
mov dword [rbp + 0x12c], eax
nop
jmp 0x401cf4
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x120]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x401cb1
mov rax, qword [rbp + 0x120]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rbp + 0x11c], 0x1f0fff
mov edx, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x11c]
mov r8d, edx
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x110], rax
lea rdx, [rbp + 0xf2]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], 0
mov r9d, 2
mov r8, rdx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
sete al
test al, al
je 0x401d90
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x401f3f
movzx edx, word [rbp + 0xf2]
movzx eax, word [rbp + 0x148]
cmp dx, ax
jne 0x401e77
mov qword [rbp + 0x108], 2
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
mov rcx, qword [rbp + 0x108]
lea rdx, [rbp + 0x150]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, rdx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0x104], eax
mov r8d, dword [rbp + 0xec]
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, r8d
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
cmp dword [rbp + 0x104], 0
je 0x401e72
mov eax, 0
jmp 0x401f3f
jmp 0x401f3f
mov qword [rbp + 0xf8], 2
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
mov rcx, qword [rbp + 0xf8]
lea rdx, [rbp + 0x148]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, rdx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov dword [rbp + 0xf4], eax
mov r8d, dword [rbp + 0xec]
mov rcx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x110]
lea rdx, [rbp + 0xec]
mov qword [rsp + 0x20], rdx
mov r9d, r8d
mov r8, rcx
mov rdx, qword [rbp + 0x140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
cmp dword [rbp + 0xf4], 0
je 0x401f3f
mov eax, 0
jmp 0x401f3f
add rsp, 0x1b0
pop rbp
ret