analysis.architecture == malcat.Architecture.X64 and ".rdata" in analysis.map and analysis.file.search("CLIENT libcurl ", analysis.map[".rdata"].phys, min(analysis.map[".rdata"].phys_size, 10000000))[1]
