"""ADVERSARIAL Q3.

Attacking dim1 claim 10: "sortPriority is inert at the UI. It reaches pack+0x1a0 and is
pushed to no Flash field ... Both are dead ends for this bug."
An objdump scan of the store cluster found 0x1800108cd/0x1800108d3
    mov eax,[rsi+0x1a0] ; cmp [rbx+0x1a0],eax
which is the shape of a SORT COMPARATOR on two 0x1a8 models, and 0x18002cc62
    mov [rbx+0x1a0],esi
inside FUN_18002cc90, which FUN_18002c3c0 tail-calls AFTER setting +0x1a0 = sortPriority.
Both were missed by "grep the push list".

Also decompile:
  FUN_18002c8b0  -- the per-group filter in FUN_180014610; if it can HIDE a group the
                    tile ordinals the user sees stop matching the group ordinals.
  FUN_18007e5e0 / FUN_18007df60 -- the six-panel binding (dim1 claim 7).
  FUN_18007e7f0 cases 0x7551 / 0x753f -- the CATEGORY_ID round trip.
  callers of FUN_1800147f0.
"""
import sys, traceback
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/adv/q3_out.txt"
try:
    fh = open(OUT, "w")
    def P(*a):
        s = " ".join(str(x) for x in a)
        print(s); fh.write(s + "\n")

    for a in (0x1800108cd, 0x18002cc62, 0x180010b5c, 0x180011c2c):
        f = func(a)
        P("%#x -> %s @ %#x size=%#x" % (a, f.getName() if f else "NONE",
          int(f.getEntryPoint().getOffset()) if f else 0,
          int(f.getBody().getNumAddresses()) if f else 0))

    P()
    P("=== callers of FUN_1800147f0 ===")
    for frm, typ, fn, ent in xrefs_to(0x1800147f0):
        P("   from %#x %s in %s @ %#x" % (frm, typ, fn, ent))
    P("=== callers of FUN_180014610 ===")
    for frm, typ, fn, ent in xrefs_to(0x180014610):
        P("   from %#x %s in %s @ %#x" % (frm, typ, fn, ent))
    P("=== callers of FUN_18002c8b0 ===")
    for frm, typ, fn, ent in xrefs_to(0x18002c8b0):
        P("   from %#x %s in %s @ %#x" % (frm, typ, fn, ent))
    P("=== callers of the comparator's containing function ===")
    cf = func(0x1800108cd)
    if cf:
        for frm, typ, fn, ent in xrefs_to(int(cf.getEntryPoint().getOffset())):
            P("   from %#x %s in %s @ %#x" % (frm, typ, fn, ent))

    tg = []
    if cf: tg.append(int(cf.getEntryPoint().getOffset()))
    tg += [0x18002cc90, 0x18002c8b0, 0x18007e5e0, 0x18007df60, 0x180014b60]
    for t in tg:
        f = func(t)
        P()
        P("======== DECOMPILE %s @ %#x ========" % (f.getName() if f else "?", t))
        src = dec(t, 300)
        P("len(src) =", len(src))
        P(src)
        P("======== END %#x ========" % t)

    # full FUN_18007e7f0 (big) -- print only, it is the CATEGORY_ID round trip
    P()
    P("======== DECOMPILE FUN_18007e7f0 (full) ========")
    src = dec(0x18007e7f0, 600)
    P("len(src) =", len(src))
    P(src)
    P("======== END ========")
    fh.close()
except Exception:
    traceback.print_exc()
    try: fh.close()
    except Exception: pass