Identifying dormant functionality in malware programs