1. At a computer system, the computer system including a processor and system memory, a method for identifying execution behavior for a portion of binary code, the method comprising: an act of accessing a portion of assembly code, the portion of assembly code disassembled from the portion of binary code, the portion of assembly code including assembly language instructions from an assembly language instruction set; an act of converting the portion of assembly code to an intermediate representation, the intermediate representation including intermediate representation instructions from an intermediate representation instruction set, converting the portion of assembly code including: an act of mapping each assembly language instruction to a corresponding ordered list of one or more intermediate representation instructions so as to reduce the complexity of analyzing the behavior of the portion of binary code; an act of tracking the path of one or more parameters within functions of the intermediate representation to identify one or more of: parameter values and parameter types used to call functions of interest within the portion of binary code; and an act of outputting one or more of: functions, parameter values, and parameters types of interest for the portion of binary code.