Lets say a program (client) sets up a socket and sends data to a server. Lets say I want to know exactly what I am sending in the data portion of that socket however it is encrypted. Is there a way I can find in the client's process what section of memory holds the buffer of data to be sent over the network before it gets encrypted? Would I need to disassemble the program or is there another way?

This is for educational purposes.
Thanks