0x00001600 53 push rbx

│ 0x00001601 4883ec50 sub rsp, 0x50

│ 0x00001605 48b8524956.. movabs rax, 0x49494a4079564952 ;
'RIVy@JII'
│ 0x0000160f 4889442447 mov qword [var_47h], rax
│ 0x00001614 c644244f54 mov byte [var_4fh], 0x54 ; 'T'
│ ; [0x54:1]=0
│ 0x00001619 488d3d7210.. lea rdi, str._nLevel_3________________ ;
0x2692 ; "\nLevel 3 --------------- " ; const char *s
│ 0x00001620 e82bfaffff call sym.imp.puts ; int
puts(const char *s)
│ 0x00001625 488d3d9410.. lea rdi,
str.You_stand_inside_the_lift_to_Pico_le_Crocos_luxurious_apartment_in_Monaco. ;
0x26c0 ; "You stand inside the lift to Pico le Croco's luxurious apartment in
Monaco." ; const char *s
│ 0x0000162c e81ffaffff call sym.imp.puts ; int
puts(const char *s)
│ 0x00001631 488d3dd810.. lea rdi,
str.The_lifts_panel_glows_softly__but_theres_no_indication_of_which_floor_you_need.
_n ; 0x2710 ; "The lift's panel glows softly, but there's no indication of which
floor you need.\n" ; const char *s
│ 0x00001638 e813faffff call sym.imp.puts ; int
puts(const char *s)
│ 0x0000163d 488d3d6810.. lea rdi, str.Floor: ; 0x26ac ;
"Floor: " ; const char *format
│ 0x00001644 b800000000 mov eax, 0
│ 0x00001649 e832faffff call sym.imp.printf ; int
printf(const char *format)
│ 0x0000164e 4889e3 mov rbx, rsp
│ 0x00001651 4889de mov rsi, rbx
│ 0x00001654 488d3d5910.. lea rdi, str._63s ; 0x26b4 ;
"%63s" ; const char *format
│ 0x0000165b b800000000 mov eax, 0
│ 0x00001660 e8dbfaffff call sym.imp.__isoc99_scanf ; int
scanf(const char *format)
│ 0x00001665 bf0a000000 mov edi, 0xa ; int c
│ 0x0000166a e8d1f9ffff call sym.imp.putchar ; int
putchar(int c)
│ 0x0000166f 4889df mov rdi, rbx ; const char
*s
│ 0x00001672 e8f9f9ffff call sym.imp.strlen ; size_t
strlen(const char *s)
│ 0x00001677 ba00000000 mov edx, 0
│ 0x0000167c 488d742446 lea rsi, [var_46h]
│ ; CODE XREF from sym.level3 @ 0x1694(x)
│ ┌─> 0x00001681 4839d0 cmp rax, rdx
│ ┌──< 0x00001684 743f je 0x16c5
│ │╎ 0x00001686 0fb60c14 movzx ecx, byte [rsp + rdx]
│ │╎ 0x0000168a 83f126 xor ecx, 0x26
│ │╎ 0x0000168d 4883c201 add rdx, 1
│ │╎ 0x00001691 3a0c16 cmp cl, byte [rsi + rdx]
│ │└─< 0x00001694 74eb je 0x1681
│ │ ; CODE XREF from sym.level3 @ 0x16c9(x)
│ │┌─> 0x00001696 488d3dbb11.. lea rdi,
str.The_lift_closes_its_doors..._and_brings_you_down_to_the_garbage_level. ; 0x2858
; "The lift closes its doors... and brings you down to the garbage level." ; const
char *s
│ │╎ 0x0000169d e8aef9ffff call sym.imp.puts ; int
puts(const char *s)
│ │╎ 0x000016a2 488d3df711.. lea rdi,
str.For_sure__thats_not_where_Pico_le_Croco_lives_:_ ; 0x28a0 ; "For sure, that's
not where Pico le Croco lives :(" ; const char *s
│ │╎ 0x000016a9 e8a2f9ffff call sym.imp.puts ; int
puts(const char *s)
│ │╎ 0x000016ae 488d3d2312.. lea rdi,
str.Looks_like_you_need_to_figure_out_the_correct_floor_code_to_proceed. ; 0x28d8 ;
"Looks like you need to figure out the correct floor code to proceed." ; const char
*s
│ │╎ 0x000016b5 e896f9ffff call sym.imp.puts ; int
puts(const char *s)
│ │╎ 0x000016ba b800000000 mov eax, 0
│ │╎ ; CODE XREF from sym.level3 @ 0x16f4(x)
│ ┌───> 0x000016bf 4883c450 add rsp, 0x50
│ ╎│╎ 0x000016c3 5b pop rbx
│ ╎│╎ 0x000016c4 c3 ret
│ ╎│╎ ; CODE XREF from sym.level3 @ 0x1684(x)
│ ╎└──> 0x000016c5 4883f809 cmp rax, 9
│ ╎ └─< 0x000016c9 75cb jne 0x1696
│ ╎ 0x000016cb 488d3d9610.. lea rdi,
str._nThe_lift_dings_softly__and_the_doors_open_to_reveal_a_golden_floor_interior.
; 0x2768 ; "\nThe lift dings softly, and the doors open to reveal a golden floor
interior." ; const char *s
│ ╎ 0x000016d2 e879f9ffff call sym.imp.puts ; int
puts(const char *s)
│ ╎ 0x000016d7 488d3dda10.. lea rdi,
str.Congratulations__youve_completed_this_level__Will_you_manage_to_meet_Pico_at_th
e_next_level_ ; 0x27b8 ; "Congratulations, you've completed this level! Will you
manage to meet Pico at the next level?" ; const char *s
│ ╎ 0x000016de e86df9ffff call sym.imp.puts ; int
puts(const char *s)
│ ╎ 0x000016e3 488d3d2e11.. lea rdi,
str.Ph0wn_CTF_2026___March_13_14__2026__Visit_us_at_ph0wn.org ; 0x2818 ; "Ph0wn CTF
2026 - March 13-14, 2026 | Visit us at ph0wn.org" ; const char *s
│ ╎ 0x000016ea e861f9ffff call sym.imp.puts ; int
puts(const char *s)
│ ╎ 0x000016ef b801000000 mov eax, 1
└ └───< 0x000016f4 ebc9 jmp 0x16bf