We actually licensed 2 copies of IDA Pro. Our two sec bug geniuses do that work, rather than me (unless it's a Z80 worm :-)). Many of the worms are also compressed (not a big problem), and a few have been code obfuscated or partially encrypted, so there's a bit more work to it as well. The tools used to prevent code reversing to protect intellectual property do a good job of keeping a worm, etc.'s function obscure.