[Practice] Complex Functions in 3 Seconds? ⏱️ A Practical Analysis Routine: Extracting with Ghidra and Summarizing with AI!

Jul 27, 2026

—

Hello, security explorers! 🕵️‍♀️🕵️‍♂️

Until last time, we built our analysis environment and laid the groundwork for prompt engineering to ask AI ‘properly’. Now, theory is enough. It’s time to get into practice! 🔥

When analyzing real malware, it’s rare to find only a single main function. Dozens, even hundreds, of functions are intertwined like a spiderweb. 🕸️ The analyst’s skill lies in finding the “truly important function (Key Function)” among them and quickly grasping its purpose.

However, just following assembly language and complex C pseudo-code with your eyes can quickly become exhausting. 😵‍💫

In today’s practice, we will directly try a routine that “pinpoints” key functions in Ghidra, throws them to AI, and gets them “neatly” summarized, boosting analysis speed by 10 times.

Are you ready? Let’s Dive in! 🤿

🎯 Practice Goals

Identify key function blocks with high analysis value in Ghidra.
Extract (Copy) the decompiled code of the identified function.
Apply the prompt engineering learned last time to construct input for AI.
Determine the analysis direction based on the function summarized by AI.

STEP 1. “The culprit is in here!” Identifying Key Functions 🧐

There are many functions within malware, but not all are important. We need to find the core functions related to ‘malicious behavior’.

💡 Tip: Which functions should you choose?

Functions referencing suspicious strings: Functions using strings like “Encrypt”, “Cmd.exe”, “Password”, or IP addresses are strong suspects. (Utilize Ghidra’s Window -> Defined Strings)
Functions calling dangerous APIs: Follow functions that call APIs such as VirtualAlloc (memory allocation), CreateRemoteThread (injection), connect (network), WriteFile (file creation). (Utilize Ghidra’s Symbol Tree -> Imports)
Functions performing complex operations: If there are many loops (for/while) and XOR, Shift operations, it’s highly likely to be an encryption or obfuscation-decryption routine.

[Assumed Practice Scenario] During our analysis, we found a function in a ransomware-suspected sample that opens a file, performs some complex loop, and then writes to the file again! Its name is FUN_1400012a0, arbitrarily assigned by Ghidra.

STEP 2. Code Extraction: “Ctrl+C, The Art of Copying” 📋

The code displayed in Ghidra’s Decompiler view is our target for analysis.

Select Function: Click inside the function you want to analyze (FUN_1400012a0).
Select All Code: Drag with the mouse in the Decompiler window or press Ctrl + A to select the entire function code.
Copy: Press Ctrl + C to copy to the clipboard.

⚠️ Caution: If the function is too long (e.g., thousands of lines), it may exceed the AI’s input limit (Token limit). In such cases, it’s wise to copy only essential loop or conditional blocks partially!

STEP 3. Interrogating AI: “Now, let’s ask as we learned!” 🗣️

Now, take the copied code to AI (ChatGPT, Claude, etc.). Remember the magic formula we learned last time?

[Persona] + [Context] + [Data (Code)] + [Instructions (Goal)]

Let’s apply this formula to write the prompt.

🧑‍💻 [My Prompt Input]:

**역할 (Persona):** 당신은 시니어 악성코드 리버스 엔지니어입니다.

**컨텍스트 (Context):** 나는 현재 랜섬웨어로 의심되는 윈도우 실행 파일(.exe)을 분석 중입니다. 기드라(Ghidra)를 통해 파일을 열고 쓰기 작업을 수행하는 것으로 보이는 의심스러운 함수 하나를 추출했습니다.

**지시사항 (Goal):**
1. 아래 제공된 C언어 의사 코드(Pseudo-code)의 핵심 기능을 **3줄 이내로 요약**해주세요.
2. 이 함수가 악성 행위(예: 파일 암호화, 데이터 유출 등)와 관련이 있을 가능성을 '상/중/하'로 평가하고 그 이유를 설명해주세요.
3. 코드 내에서 주목해야 할 중요한 지역 변수나 파라미터가 있다면 지적해주세요.

**코드 (Data):**

// (Paste the code you copied from Ghidra here)

// Example code (It would be much more complex in reality, but just get the idea!)

void FUN_1400012a0(char *filePath, byte *key, int keyLen) {

HANDLE hFile = CreateFileA(filePath, …);

// … File reading omitted …

byte *fileBuffer = VirtualAlloc(…, fileSize, …);

ReadFile(hFile, fileBuffer, …);

// Suspicious loop starts

for (int i = 0; i < fileSize; i++) {

fileBuffer[i] = fileBuffer[i] ^ key[i % keyLen]; // XOR operation

}

SetFilePointer(hFile, 0, NULL, FILE_BEGIN);

WriteFile(hFile, fileBuffer, …); // Overwrite

CloseHandle(hFile);

}

“`

STEP 4. Analyzing Results: Verify AI’s Answer! ✅

AI has provided an answer. We need to check the results and verify if they align with our analysis direction.

🤖 [AI’s Answer Example]:

📝 Key Function Summary: This function opens the file at the specified file path (filePath), allocates memory (VirtualAlloc), performs a byte-wise XOR operation using the provided key, and overwrites the original file with the result.

🚨 Malicious Potential Assessment: [High] Reason: The act of reading file content, modifying it with an XOR operation (the most basic encryption/obfuscation technique), and then overwriting the original is a very typical pattern seen in ransomware’s file encryption routines. It is rare for legitimate programs to overwrite files in this manner.

👀 Variables to Note:

– filePath (Parameter 1): It is necessary to check which file is the target of encryption.

– key (Parameter 2): This is the key value used for encryption. It is important to trace where this key was generated. (Crucial for creating a decryption tool!)

🎉 Practice Conclusion: A Revolution in Analysis Speed

How was it? By throwing a complex block of code to AI, in just a few seconds, we grasped the core: “Ah, this is a ransomware encryption routine. Finding the key will be important!” ⚡

If I had interpreted this line by line myself, it would have easily taken 20-30 minutes. AI saves our time and helps us see the forest for the trees.

Don’t forget today’s core routine:

Find the suspicious one in Ghidra. 🕵️
Copy the code. 📋
Ask AI, giving it a persona. 🗣️
Determine the next analysis target based on the answer. (e.g., Let’s trace who passes the ‘key’ parameter!)

Next time, we will explore how to link this with ‘dynamic analysis’ to check what data is exchanged when the functions identified as “suspicious” by AI actually operate.

Have a day filled with the joy of analysis! Fighting! 💪