diff --git a/load-code/pe/enumerate-pe-sections.yml b/load-code/pe/enumerate-pe-sections.yml
index 4f71aa8a..11e757fd 100644
--- a/load-code/pe/enumerate-pe-sections.yml
+++ b/load-code/pe/enumerate-pe-sections.yml
@@ -15,25 +15,41 @@ rule:
   features:
     - and:
       - os: windows
-      - offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
+      # there should be some complexity to functions like this
+      - count(basic blocks): 3 or more
+      - optional:
+        - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
+      - instruction:
+        - or:
+          - mnemonic: mov
+          - mnemonic: movzx
+        - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
       - basic block:
         - or:
           - and:
             - description: IMAGE_FIRST_SECTION(nt_header)
-            - offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
-            - offset: 0x18 = FileHeader.SizeOfOptionalHeader
+            - instruction:
+              - or:
+                - mnemonic: add
+                - mnemonic: mov
+                - mnemonic: movzx
+              - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
+            - operand[1].offset: 0x18 = FileHeader.SizeOfOptionalHeader
           - and:
             - description: (DWORD)dll_raw + dos_header->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * i
             - number: 0x28 = sizeof(IMAGE_SECTION_HEADER)
             - or:
               - and:
                 - arch: i386
-                - offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32)
+                - operand[1].offset: 0xF8 = sizeof(IMAGE_NT_HEADERS32)
               - and:
                 - arch: amd64
-                - offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)
+                - operand[1].offset: 0x108 = sizeof(IMAGE_NT_HEADERS64)
       - basic block:
         - and:
-          - offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress
-          - offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData
-          - offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData
+          - operand[1].offset: 0xC = IMAGE_SECTION_HEADER.VirtualAddress
+          - operand[1].offset: 0x14 = IMAGE_SECTION_HEADER.PointerToRawData
+          - operand[1].offset: 0x10 = IMAGE_SECTION_HEADER.SizeOfRawData
+          - not:
+            # non-zeroing XOR was observed in FPs
+            - characteristic: nzxor
diff --git a/load-code/pe/parse-pe-header.yml b/load-code/pe/parse-pe-header.yml
index e45d17b8..5820c0a3 100644
--- a/load-code/pe/parse-pe-header.yml
+++ b/load-code/pe/parse-pe-header.yml
@@ -10,7 +10,6 @@ rule:
     examples:
       - 9324D1A8AE37A36AE560C37448C9705A:0x403DD0
   features:
-    # TODO filter out false positives
     - and:
       - os: windows
       - and:
@@ -27,31 +26,31 @@ rule:
             - number: 0x5A
         - optional:
           - and:
-            - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
+            - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
             - or:
               - and:
                 - arch: i386
-                - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
-                - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
+                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
+                - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
               - and:
                 - arch: amd64
-                - offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
-                - offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase
+                - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
+                - operand[1].offset: 0x30 = IMAGE_NT_HEADERS64.OptionalHeader.ImageBase
           - basic block:
             - and:
-              - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
+              - operand[1].offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
               - 3 or more:
-                - offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine
-                - offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
-                - offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
-                - offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics
-                - offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit
+                - operand[1].offset: 0x4 = IMAGE_NT_HEADERS.FileHeader.Machine
+                - operand[1].offset: 0x6 = IMAGE_NT_HEADERS.FileHeader.NumberOfSections
+                - operand[1].offset: 0x14 = IMAGE_NT_HEADERS.FileHeader.SizeOfOptionalHeader
+                - operand[1].offset: 0x16 = IMAGE_NT_HEADERS.FileHeader.Characteristics
+                - operand[1].offset: 0x28 = IMAGE_NT_HEADERS.OptionalHeader.AddressOfEntryPoint  # for 32 and 64 bit
                 - or:
                   - and:
                     - arch: i386
-                    - offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
-                    - offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
+                    - operand[1].offset: 0x34 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
+                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage
                   - and:
                     - arch: amd64
-                    - offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
-                    - offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage
+                    - operand[1].offset: 0x30 = IMAGE_NT_HEADERS.OptionalHeader.ImageBase
+                    - operand[1].offset: 0x50 = IMAGE_NT_HEADERS64.OptionalHeader.SizeOfImage