1. A computer-implemented method for collecting functions from a plurality of malware files into a database, the collected functions being expressed by respective function abstractions, the method comprising the steps of: generating an abstraction for a function of interest, the function of interest being parsed from assembly language instructions from a disassembled file containing suspected malware; and cross referencing the collected functions in the database to the function of interest by invoking a comparison of the abstraction of the function of interest to the abstracted functions in the database.