At least one machine readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to: run an application in a sandbox environment, wherein the application includes a plurality of function calls, log parameters for each function call of the application during run time in the sandbox environment, wherein the logged parameters include each function call, input parameters for each function call, and output parameters for each function call, store the logged parameters in an emulation table, characterized in that the one or more instructions, when executed, further cause the at least one processor to: use the logged parameters in a simulation environment to simulate execution of the application, and analyze the simulation of the execution of the application for the presence of malware, wherein simulating execution of a function call of the application comprises simulating the function call without having to run the function call by: determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call, and in response to determining the current simulation environment parameter set matches the logged input parameters, returning the logged output parameters for the function call. run an application in a sandbox environment, wherein the application includes a plurality of function calls, log parameters for each function call of the application during run time in the sandbox environment, wherein the logged parameters include each function call, input parameters for each function call, and output parameters for each function call, store the logged parameters in an emulation table, characterized in that the one or more instructions, when executed, further cause the at least one processor to: use the logged parameters in a simulation environment to simulate execution of the application, and analyze the simulation of the execution of the application for the presence of malware, wherein simulating execution of a function call of the application comprises simulating the function call without having to run the function call by: determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call, and in response to determining the current simulation environment parameter set matches the logged input parameters, returning the logged output parameters for the function call. use the logged parameters in a simulation environment to simulate execution of the application, and analyze the simulation of the execution of the application for the presence of malware, wherein simulating execution of a function call of the application comprises simulating the function call without having to run the function call by: determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call, and in response to determining the current simulation environment parameter set matches the logged input parameters, returning the logged output parameters for the function call. determining from the emulation table whether a current simulation environment parameter set for the function call matches logged input parameters for the function call, and in response to determining the current simulation environment parameter set matches the logged input parameters, returning the logged output parameters for the function call.