How else can you patch an exploit if you don't try it first? The first step in reverse engineering malware is to try the exploit in a controlled environment.