In general it is impossible to recontruct the original PE file from memory since some modifications cannot be undone:
- Some pages may be missing from memory
Don't expect the recovered PE files to be runnable
Recovered PE files are sufficent for analysis with IDA Pro or to upload to Virustotal.
Malware sometimes modifies /destructs the PE header in memory to make reconstruction hard/impossible
PE files in memory contains more information than PE files on disk:
- DLLs used by PE file
- Dynamic data such as heap and stack