static analysis of memory dumps to find capabilities

It would be useful to run capa against memory snapshots, such as those derived from sandbox executions, to identify capabilities of unpacked software.

There might be some subtlety and/or challenges around restricting the feature extraction to the "interesting" regions of memory, like the target image and dynamically allocated regions, skipping libraries. Also, there are potentially many memory image formats to handle. And, we'd need to find/implement solid code analysis in these memory images which might take some work. Do we re-add SMDA as a backend?

This is potentially related to #1649 in that TTD may provide memory snapshots from specific points within a trace to this feature extractor backend.

Begin by reviewing the existing capa feature-extraction backends, the prior SMDA backend, and related issue #1649 about TTD memory snapshots. Define which memory image formats and regions are supported, including target images and dynamically allocated regions while excluding libraries. Done means capa can analyze supported memory snapshots and identify capabilities with solid code analysis.

Written by the indexing model from the issue text.