1. A method for emulating a file on a computer system, the method comprising: loading the file into an emulator of the computer system; initiating emulation of the file by the emulator; storing a first image of an initial state of the emulator in a tree data structure; continuing the emulation of the file and detecting an occurrence of a condition that results during the emulation of the file; creating and storing a second image of a second state of the emulator in the tree data structure when the occurrence of the condition is detected; determining that the emulation of the file has terminated correctly in response to at least detecting a harmful behavior of the file during the emulation; determining that the emulation of the file has terminated incorrectly in response to detecting an occurrence of an anti-emulation trick; and upon determining that the emulation of the file has terminated incorrectly, navigating along the tree data structure to identify the second image of the second state of the emulator as a state of the emulator prior to the incorrect termination, loading the second image of the second state into the emulator and resuming the emulation of the file from the second state of the emulators; performing a change to a state of the resumed emulation to circumvent the anti-emulation trick, wherein the change to the state of the resumed emulation includes at least one of a jump to a different code branch at a conditional jump, a change in a status of a resource handler, a reversal of a previously made change, and a change to a return value an executed function.