1. A computer-implemented method to detect malware on a computing system, the method comprising: employing a behavior analysis application running on an operating system of the computing system to perform an accelerated emulation of an untrusted computer file by emulating a first code sequence of a plurality of code sequences of the untrusted computer file in a virtual environment; and upon identifying a known code sequence in the untrusted computer file, executing outside the virtual environment a native-code routine functionally implementing the known code sequence, wherein the native-code routine comprises a routine selected from a group consisting of a decompression routine, a decryption routine, and a checksum routine; and determining whether the untrusted computer file is malicious according to a result of the accelerated emulation.