A method for identifying execution behavior for a portion of binary code at a computer system, the computer system including a processor and system memory, the method comprising: accessing a portion of assembly code, the portion of assembly code disassembled from the portion of binary code, the portion of assembly code including assembly language instructions from an assembly language instruction set; converting the portion of assembly code into an intermediate representation, the intermediate representation including intermediate representation instructions from an intermediate representation instruction set, converting the portion of assembly code including: analyzing the portion of assembly code to identify each location where the portion of assembly code calls an operating system function; demarking each transition between user functions and operating system functions based on the identified locations; mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions, by mapping each of the user functions to the corresponding ordered list of one or more intermediate representation instructions while ignoring the operating system functions, wherein the mapped ordered lists of one or more intermediate representation instructions include fewer instructions overall than the corresponding portion of assembly code; tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of: parameter values and parameter types used to call functions of interest within the portion of binary code; and outputting one or more of: functions, parameter values, and parameters types of interest for the portion of binary code. accessing a portion of assembly code, the portion of assembly code disassembled from the portion of binary code, the portion of assembly code including assembly language instructions from an assembly language instruction set; converting the portion of assembly code into an intermediate representation, the intermediate representation including intermediate representation instructions from an intermediate representation instruction set, converting the portion of assembly code including: analyzing the portion of assembly code to identify each location where the portion of assembly code calls an operating system function; demarking each transition between user functions and operating system functions based on the identified locations; mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions, by mapping each of the user functions to the corresponding ordered list of one or more intermediate representation instructions while ignoring the operating system functions, wherein the mapped ordered lists of one or more intermediate representation instructions include fewer instructions overall than the corresponding portion of assembly code; tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of: parameter values and parameter types used to call functions of interest within the portion of binary code; and analyzing the portion of assembly code to identify each location where the portion of assembly code calls an operating system function; demarking each transition between user functions and operating system functions based on the identified locations; mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions, by mapping each of the user functions to the corresponding ordered list of one or more intermediate representation instructions while ignoring the operating system functions, wherein the mapped ordered lists of one or more intermediate representation instructions include fewer instructions overall than the corresponding portion of assembly code; tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of: parameter values and parameter types used to call functions of interest within the portion of binary code; and outputting one or more of: functions, parameter values, and parameters types of interest for the portion of binary code.