Parameterize table name in dynamic SQL
You can't parameterize entity names (tables, columns, views, etc). You need to do it the riskier way:

        DECLARE @SQL NVARCHAR(MAX) = N'
        SELECT * FROM ' + QUOTENAME(@TblName) + N' WHERE 1=1'
        + CASE WHERE @Condition IS NOT NULL THEN
        ' AND ' + @Condition ELSE N'' END

        DECLARE @params NVARCHAR(MAX) = N'
            @Condition VARCHAR(MAX)';

        PRINT @SQL

        EXEC sys.sp_executesql @SQL, @params,
            @Condition


QUOTENAME() is typically enough to protect from dangerous execution (leading, potentially, to SQL injection), but to make it a little more secure you should consider (a) prefixing the table name with the correct schema prefix (e.g. ...FROM dbo.' + QUOTENAME(@TblName) + ... and (b) checking for existence first:

IF NOT EXISTS (SELECT 1 FROM sys.tables WHERE name = @TblName)
BEGIN
  RAISERROR(N'Nice try, robot.', 11, 1);
  RETURN;
END

DECLARE @SQL ...