dynamic analysis via TTD traces

Nobody has claimed this yet.

we can process WinDbg Time Travel Debugging (TTD) traces and extract API calls, string/data references, and other features and analyze them in a dynamic context, like @yelhamer has done with the CAPE sandbox. in a sense, we'd be using TTD as a sandbox.

there would be a good amount of code needed to recognize the interesting cursor locations to pause at (API calls) and the techniques to extract arguments, data references, etc.

we should attempt this after the initial CAPE backend has landed so that capa has all the necessary machinery for dynamic analysis.

i think once this is implemented, we'd be able to do some really cool things around TTD trace visualization, like "here's an interesting point in the program execution, do you want to jump to it in IDA or Binary Ninja?".

this issue differs from #1649 in that this issue is about dynamic analysis of TTD traces, while the other issue is about static analysis of specific snapshots within a TTD trace.

Start by reviewing the initial CAPE backend, which this work is explicitly waiting for, and compare its dynamic-analysis machinery with the distinction from issue #1649. Define how TTD traces should be processed, including API-call cursor locations and extraction of arguments and data references. Done means dynamic TTD analysis works and supports the proposed trace-visualization workflow.

Written by the indexing model from the issue text.