// File: /workspace/github_cpp_makefile_star2_O1/4n6ist[P]usn_analytics/lib/usnjrnl.cpp
// Function: UsnJrnl::GetAllDirName()
int UsnJrnl::GetAllDirName() {

  historical_dir hdir;
  uint32_t pid;
  
  // root directory
  hdir.name = "\\";
  hdir.pid = 0;
  hdir.usn = 0;
  path_table.insert(make_pair(5, hdir));

  // directory table
  for(UsnMain x: usnmain_set) {
    if (x.attrs_i & FOLDER) {
      if (x.file_name.size() == 0)
        continue;
      if (x.file_name.find("\\", x.file_name.size()-1) == string::npos) // filename doesn't end with "\"
        continue;
      if (x.file_name == "<Can't Convert>")
        continue;
      if (x.cid == x.pid) // ignore unusual pattern
        continue;
      hdir.name = x.file_name;
      hdir.pid = x.pid;
      hdir.usn = x.usn;
      dir_table.insert(make_pair(x.cid, hdir));
      // hard coding
      if (hdir.name == "Public") {
        hdir.name = "Users";
        hdir.pid = 5;
        hdir.usn = 0;
        dir_table.insert(make_pair(x.cid, hdir));
      } else if (hdir.name == "Default") {
        hdir.name = "Users";
        hdir.pid = 5;
        hdir.usn = 0;
        dir_table.insert(make_pair(x.cid, hdir));
      } else if (hdir.name == "System32") {
        hdir.name = "Windows";
        hdir.pid = 5;
        hdir.usn = 0;
        dir_table.insert(make_pair(x.cid, hdir));
      } else if (hdir.name == "Prefetch") {
        hdir.name = "Windows";
        hdir.pid = 5;
        hdir.usn = 0;
        dir_table.insert(make_pair(x.cid, hdir));
      }
      //fprintf(fp_ofexecuted, "%lld, %s, %lld, %lld\n", x.cid, hdir.name.c_str(), hdir.pid, hdir.usn);
    }
  }
  uint32_t dir_table_size = dir_table.size();

  uint64_t i=1;
  uint64_t progress = dir_table_size / 10;
    
  // fullpath table
  for(auto x : dir_table) {  // x.first is cid, x.second is hdir
    if (i >= progress) {
  	  printf(".");
      progress += dir_table_size / 10;
    }
    ++i;

    hdir = GetHistoricalFileName(x.second, 0);
    path_table.insert(make_pair(x.first, hdir));
    //fprintf(fp_ofopened, "%lld, %s, %lld, %lld\n", x.first, hdir.name.c_str(), hdir.pid, hdir.usn);
  }

  uint64_t usnmain_set_size = usnmain_set.size();
  progress = usnmain_set_size / 10;
  
  // store into file_path with usnmain_set
  for(i=0; i+1 < usnmain_set_size; i++) {
    if (i >= progress) {
  	  printf(".");
      progress += usnmain_set_size / 10;
    }
    // examine correct path
    size_t count;
    count = path_table.count(usnmain_set[i].pid);
    if (count == 0) {
      usnmain_set[i].file_path = "";
    }
    else if (count == 1) {
      auto itr = path_table.find(usnmain_set[i].pid);   
      usnmain_set[i].file_path = itr->second.name;
    }
    else {
      int64_t diff = INT64_MAX;
      string pname;
      auto itr = path_table.equal_range(usnmain_set[i].pid);
      for (auto iterator = itr.first; iterator != itr.second; iterator++) {
      //  if (usn_record.Usn - iterator->second.usn > 0) {
        if (abs(int64_t(usnmain_set[i].usn - iterator->second.usn)) < diff) {
          diff = usnmain_set[i].usn - iterator->second.usn;
          pname = iterator->second.name;
        }
      }
      usnmain_set[i].file_path = pname;
    }
  }
  
  printf("Done\n");
  return 0;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x198, %rsp            # imm = 0x198
movq %rdi, 0x8(%rsp)
leaq 0x5c(%rsp), %r14
movq %r14, -0x10(%r14)
movq $0x0, -0x8(%r14)
movb $0x0, (%r14)
leaq 0xa234(%rip), %rcx      # 0xf19e
leaq 0x4c(%rsp), %rdi
movl $0x1, %r8d
xorl %esi, %esi
xorl %edx, %edx
callq 0x33f0
movl $0x0, 0x6c(%rsp)
movq $0x0, 0x70(%rsp)
leaq 0x8c(%rsp), %rdi
movl $0x5, -0x4(%rdi)
leaq 0x9c(%rsp), %rax
movq %rax, -0x10(%rax)
movq 0x4c(%rsp), %rsi
movq 0x54(%rsp), %rdx
addq %rsi, %rdx
callq 0x9574
leaq 0x6c(%rsp), %rcx
movq 0x8(%rsp), %rax
leaq 0xc8(%rax), %rdi
movl 0x8(%rcx), %eax
leaq 0x88(%rsp), %rsi
movl %eax, 0x2c(%rsi)
movq (%rcx), %rax
movq %rax, 0x24(%rsi)
movq %rdi, 0x80(%rsp)
callq 0xa8fc
movq 0x8c(%rsp), %rdi
leaq 0x9c(%rsp), %rax
cmpq %rax, %rdi
je 0x5014
movq 0x9c(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x8(%rsp), %rax
movq 0x50(%rax), %r15
movq 0x58(%rax), %rbp
cmpq %rbp, %r15
je 0x54bf
leaq 0xc2(%rsp), %rbx
movq 0x8(%rsp), %rax
addq $0x98, %rax
movq %rax, 0x10(%rsp)
leaq 0x30(%rsp), %r13
leaq 0x142(%rsp), %r12
leaq 0x11a(%rsp), %r14
leaq 0x88(%rsp), %rdi
movq %r15, %rsi
callq 0x90a6
testb $0x10, 0x106(%rsp)
je 0x5406
movq 0xca(%rsp), %rdx
testq %rdx, %rdx
je 0x5406
decq %rdx
movl $0x1, %ecx
movq %rbx, %rdi
leaq 0xa106(%rip), %rsi      # 0xf19e
callq 0x3460
cmpq $-0x1, %rax
je 0x5406
movq %rbx, %rdi
leaq 0xa0ef(%rip), %rsi      # 0xf1a0
callq 0x30a0
testl %eax, %eax
je 0x5406
movl 0x12a(%rsp), %eax
cmpl 0x12e(%rsp), %eax
je 0x5406
leaq 0x4c(%rsp), %rdi
movq %rbx, %rsi
callq 0x3120
movq %r12, %r14
movq %rbx, %r12
movl 0x12e(%rsp), %eax
movl %eax, 0x6c(%rsp)
movq 0x88(%rsp), %rax
movq %rax, 0x70(%rsp)
movl 0x12a(%rsp), %eax
movl %eax, 0x1c(%rsp)
movq %r13, %rbx
movq %r13, 0x20(%rsp)
movq 0x4c(%rsp), %rsi
movq 0x54(%rsp), %rdx
addq %rsi, %rdx
leaq 0x20(%rsp), %r13
movq %r13, %rdi
callq 0x9574
leaq 0x6c(%rsp), %rcx
movl 0x8(%rcx), %eax
movl %eax, 0x28(%r13)
movq (%rcx), %rax
movq %rax, 0x20(%r13)
movq 0x10(%rsp), %rdi
leaq 0x1c(%rsp), %rsi
callq 0xaa20
movq 0x20(%rsp), %rdi
cmpq %rbx, %rdi
je 0x5163
movq 0x30(%rsp), %rsi
incq %rsi
callq 0x3230
leaq 0x4c(%rsp), %r13
movq %r13, %rdi
leaq 0xa03e(%rip), %rsi      # 0xf1b0
callq 0x30a0
testl %eax, %eax
movq %r12, %rbx
je 0x5258
movq %r13, %rdi
leaq 0xa031(%rip), %rsi      # 0xf1bd
callq 0x30a0
testl %eax, %eax
movq %r14, %r12
je 0x52e7
movq %r13, %rdi
leaq 0xa01f(%rip), %rsi      # 0xf1c5
callq 0x30a0
testl %eax, %eax
leaq 0x11a(%rsp), %r14
je 0x5370
movq %r13, %rdi
leaq 0xa011(%rip), %rsi      # 0xf1d6
callq 0x30a0
testl %eax, %eax
leaq 0x30(%rsp), %r13
jne 0x5406
movq 0x54(%rsp), %rdx
movl $0x7, %r8d
leaq 0x4c(%rsp), %rdi
xorl %esi, %esi
leaq 0x9fde(%rip), %rcx      # 0xf1ce
callq 0x33f0
movl $0x5, 0x6c(%rsp)
movq $0x0, 0x70(%rsp)
movl 0x12a(%rsp), %eax
movl %eax, 0x1c(%rsp)
movq %r13, 0x20(%rsp)
movq 0x4c(%rsp), %rsi
movq 0x54(%rsp), %rdx
addq %rsi, %rdx
leaq 0x20(%rsp), %rdi
callq 0x9574
leaq 0x6c(%rsp), %rcx
movl 0x8(%rcx), %eax
leaq 0x20(%rsp), %rdx
movl %eax, 0x28(%rdx)
movq (%rcx), %rax
movq %rax, 0x20(%rdx)
movq 0x10(%rsp), %rdi
leaq 0x1c(%rsp), %rsi
callq 0xaa20
jmp 0x53ef
movq 0x54(%rsp), %rdx
movl $0x5, %r8d
movq %r13, %rdi
xorl %esi, %esi
leaq 0x9f48(%rip), %rcx      # 0xf1b7
callq 0x33f0
movq %r14, %r12
leaq 0x11a(%rsp), %r14
leaq 0x30(%rsp), %r13
movl $0x5, 0x6c(%rsp)
movq $0x0, 0x70(%rsp)
movl 0x12a(%rsp), %eax
movl %eax, 0x1c(%rsp)
movq %r13, 0x20(%rsp)
movq 0x4c(%rsp), %rsi
movq 0x54(%rsp), %rdx
addq %rsi, %rdx
leaq 0x20(%rsp), %rdi
callq 0x9574
leaq 0x6c(%rsp), %rcx
movl 0x8(%rcx), %eax
leaq 0x20(%rsp), %rdx
movl %eax, 0x28(%rdx)
movq (%rcx), %rax
movq %rax, 0x20(%rdx)
movq 0x10(%rsp), %rdi
leaq 0x1c(%rsp), %rsi
callq 0xaa20
jmp 0x53ef
movq 0x54(%rsp), %rdx
movl $0x5, %r8d
movq %r13, %rdi
xorl %esi, %esi
leaq 0x9eb9(%rip), %rcx      # 0xf1b7
callq 0x33f0
leaq 0x11a(%rsp), %r14
leaq 0x30(%rsp), %r13
movl $0x5, 0x6c(%rsp)
movq $0x0, 0x70(%rsp)
movl 0x12a(%rsp), %eax
movl %eax, 0x1c(%rsp)
movq %r13, 0x20(%rsp)
movq 0x4c(%rsp), %rsi
movq 0x54(%rsp), %rdx
addq %rsi, %rdx
leaq 0x20(%rsp), %rdi
callq 0x9574
leaq 0x6c(%rsp), %rcx
movl 0x8(%rcx), %eax
leaq 0x20(%rsp), %rdx
movl %eax, 0x28(%rdx)
movq (%rcx), %rax
movq %rax, 0x20(%rdx)
movq 0x10(%rsp), %rdi
leaq 0x1c(%rsp), %rsi
callq 0xaa20
jmp 0x53ef
movq 0x54(%rsp), %rdx
movl $0x7, %r8d
movq %r13, %rdi
xorl %esi, %esi
leaq 0x9e47(%rip), %rcx      # 0xf1ce
callq 0x33f0
leaq 0x30(%rsp), %r13
movl $0x5, 0x6c(%rsp)
movq $0x0, 0x70(%rsp)
movl 0x12a(%rsp), %eax
movl %eax, 0x1c(%rsp)
movq %r13, 0x20(%rsp)
movq 0x4c(%rsp), %rsi
movq 0x54(%rsp), %rdx
addq %rsi, %rdx
leaq 0x20(%rsp), %rdi
callq 0x9574
leaq 0x6c(%rsp), %rcx
movl 0x8(%rcx), %eax
leaq 0x20(%rsp), %rdx
movl %eax, 0x28(%rdx)
movq (%rcx), %rax
movq %rax, 0x20(%rdx)
movq 0x10(%rsp), %rdi
leaq 0x1c(%rsp), %rsi
callq 0xaa20
movq 0x20(%rsp), %rdi
cmpq %r13, %rdi
je 0x5406
movq 0x30(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x132(%rsp), %rdi
cmpq %r12, %rdi
je 0x5423
movq 0x142(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x10a(%rsp), %rdi
cmpq %r14, %rdi
je 0x5440
movq 0x11a(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0xe6(%rsp), %rdi
leaq 0xf6(%rsp), %rax
cmpq %rax, %rdi
je 0x5465
movq 0xf6(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0xc2(%rsp), %rdi
leaq 0xd2(%rsp), %rax
cmpq %rax, %rdi
je 0x548a
movq 0xd2(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x9a(%rsp), %rdi
leaq 0xaa(%rsp), %rax
cmpq %rax, %rdi
je 0x54af
movq 0xaa(%rsp), %rsi
incq %rsi
callq 0x3230
addq $0xca, %r15
cmpq %rbp, %r15
jne 0x5057
movq 0x8(%rsp), %rax
movq 0xb0(%rax), %r15
addq $0xa0, %rax
movq %rax, 0x10(%rsp)
cmpq %rax, %r15
je 0x56d0
movq 0x8(%rsp), %rax
movl 0xc0(%rax), %eax
movl $0xcccccccd, %ebx       # imm = 0xCCCCCCCD
imulq %rax, %rbx
shrq $0x23, %rbx
leaq 0x17c(%rsp), %rbp
movl $0x1, %r14d
movq %rbx, 0x78(%rsp)
movl 0x20(%r15), %eax
movl %eax, 0x88(%rsp)
leaq 0x9c(%rsp), %rax
movq %rax, 0x8c(%rsp)
movq 0x24(%r15), %rsi
movq 0x2c(%r15), %rdx
addq %rsi, %rdx
leaq 0x8c(%rsp), %rdi
callq 0x9574
movl 0x4c(%r15), %eax
leaq 0xac(%rsp), %rcx
movl %eax, 0x8(%rcx)
movq 0x44(%r15), %rax
movq %rax, (%rcx)
cmpq %rbx, %r14
jb 0x5567
movl $0x2e, %edi
callq 0x3340
addq 0x78(%rsp), %rbx
leaq 0x16c(%rsp), %r13
movq %rbp, %r12
movq %rbp, 0x16c(%rsp)
movq 0x8c(%rsp), %rsi
movq 0x94(%rsp), %rdx
addq %rsi, %rdx
movq %r13, %rdi
callq 0x9574
leaq 0xac(%rsp), %rcx
movl 0x8(%rcx), %eax
movl %eax, 0x18(%r12)
movq (%rcx), %rax
movq %rax, 0x10(%r12)
leaq 0x1c(%rsp), %r12
movq %r12, %rdi
movq 0x8(%rsp), %rsi
movq %r13, %rdx
xorl %ecx, %ecx
callq 0x5ab2
leaq 0x4c(%rsp), %rdi
movq %r12, %rsi
callq 0x3300
leaq 0x3c(%rsp), %r12
movl 0x8(%r12), %eax
leaq 0x6c(%rsp), %rcx
movl %eax, 0x8(%rcx)
movq (%r12), %rax
movq %rax, (%rcx)
movq 0x1c(%rsp), %rdi
leaq 0x2c(%rsp), %rax
cmpq %rax, %rdi
je 0x5606
movq 0x2c(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x16c(%rsp), %rdi
cmpq %rbp, %rdi
je 0x5623
movq 0x17c(%rsp), %rsi
incq %rsi
callq 0x3230
movl 0x88(%rsp), %eax
movl %eax, 0x1c(%rsp)
leaq 0x30(%rsp), %rax
movq %rax, 0x20(%rsp)
movq 0x4c(%rsp), %rsi
movq 0x54(%rsp), %rdx
addq %rsi, %rdx
leaq 0x20(%rsp), %rdi
callq 0x9574
leaq 0x6c(%rsp), %rcx
movl 0x8(%rcx), %eax
movl %eax, 0xc(%r12)
movq (%rcx), %rax
movq %rax, 0x4(%r12)
movq 0x80(%rsp), %rdi
leaq 0x1c(%rsp), %rsi
callq 0xaa20
movq 0x20(%rsp), %rdi
leaq 0x30(%rsp), %rax
cmpq %rax, %rdi
je 0x5692
movq 0x30(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x8c(%rsp), %rdi
leaq 0x9c(%rsp), %rax
cmpq %rax, %rdi
je 0x56b7
movq 0x9c(%rsp), %rsi
incq %rsi
callq 0x3230
movq %r15, %rdi
callq 0x3150
movq %rax, %r15
incq %r14
cmpq 0x10(%rsp), %rax
jne 0x550a
movq 0x8(%rsp), %rcx
movq 0x58(%rcx), %rax
subq 0x50(%rcx), %rax
sarq %rax
movabsq $0x3a4c0a237c32b16d, %r12 # imm = 0x3A4C0A237C32B16D
imulq %rax, %r12
movabsq $-0x3333333333333333, %rcx # imm = 0xCCCCCCCCCCCCCCCD
movq %r12, %rax
mulq %rcx
cmpq $0x2, %r12
jb 0x5933
shrq $0x3, %rdx
movq 0x8(%rsp), %rax
leaq 0xd0(%rax), %r15
movl $0x1, %eax
leaq 0x98(%rsp), %r13
xorl %ebp, %ebp
movq %rdx, 0x160(%rsp)
movq %rdx, %r14
movq %r15, 0x158(%rsp)
movq %rbp, %rbx
movq %rax, %rbp
cmpq %r14, %rbx
jb 0x5757
movl $0x2e, %edi
callq 0x3340
addq 0x160(%rsp), %r14
movq %r14, 0x10(%rsp)
movq 0x8(%rsp), %rax
movq 0x50(%rax), %rax
imulq $0xca, %rbx, %r14
leaq (%rax,%r14), %rsi
addq $0xa6, %rsi
movq 0x80(%rsp), %rdi
callq 0xaafe
cmpq $0x1, %rax
je 0x57c1
testq %rax, %rax
jne 0x582b
movq 0x8(%rsp), %rax
movq 0x50(%rax), %rax
leaq (%rax,%r14), %rdi
addq $0xaa, %rdi
movq 0x8(%rdi), %rdx
xorl %esi, %esi
leaq 0x9b67(%rip), %rcx      # 0xf31b
xorl %r8d, %r8d
callq 0x33f0
jmp 0x5921
movq 0x8(%rsp), %rax
addq 0x50(%rax), %r14
movq 0xd8(%rax), %rcx
movq %r15, %rax
testq %rcx, %rcx
je 0x57fa
movl 0xa6(%r14), %edx
movq %r15, %rax
xorl %esi, %esi
cmpl %edx, 0x20(%rcx)
setb %sil
cmovaeq %rcx, %rax
movq 0x10(%rcx,%rsi,8), %rcx
testq %rcx, %rcx
jne 0x57e3
movq %r15, %rsi
cmpq %r15, %rax
je 0x5813
movl 0xa6(%r14), %ecx
cmpl 0x20(%rax), %ecx
cmovbq %r15, %rax
movq %rax, %rsi
addq $0x24, %rsi
addq $0xaa, %r14
movq %r14, %rdi
callq 0x3120
jmp 0x5921
movq %rbp, 0x78(%rsp)
movq %r12, %r15
movq %r13, 0x88(%rsp)
movq $0x0, 0x90(%rsp)
movb $0x0, 0x98(%rsp)
movq 0x8(%rsp), %rax
movq 0x50(%rax), %rax
leaq (%rax,%r14), %rsi
addq $0xa6, %rsi
movq 0x80(%rsp), %rdi
callq 0xaba8
movq %rax, %r12
movq %rdx, %r13
cmpq %rdx, %rax
je 0x58cb
movabsq $0x7fffffffffffffff, %rbp # imm = 0x7FFFFFFFFFFFFFFF
movq 0x8(%rsp), %rax
movq 0x50(%rax), %rax
movq (%rax,%r14), %rbx
subq 0x48(%r12), %rbx
movq %rbx, %rax
negq %rax
cmovsq %rbx, %rax
cmpq %rbp, %rax
jge 0x58bb
leaq 0x24(%r12), %rsi
leaq 0x88(%rsp), %rdi
callq 0x3120
movq %rbx, %rbp
movq %r12, %rdi
callq 0x3150
movq %rax, %r12
cmpq %r13, %rax
jne 0x5885
movq 0x8(%rsp), %rax
movq 0x50(%rax), %rax
leaq (%rax,%r14), %rdi
addq $0xaa, %rdi
leaq 0x88(%rsp), %rsi
callq 0x3120
movq 0x88(%rsp), %rdi
leaq 0x98(%rsp), %r13
cmpq %r13, %rdi
movq %r15, %r12
movq 0x78(%rsp), %rbp
je 0x5919
movq 0x98(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x158(%rsp), %r15
leaq 0x1(%rbp), %rax
cmpq %r12, %rax
movq 0x10(%rsp), %r14
jne 0x573a
leaq 0x9cf6(%rip), %rdi      # 0xf630
callq 0x33e0
movq 0x4c(%rsp), %rdi
leaq 0x5c(%rsp), %rax
cmpq %rax, %rdi
je 0x595b
movq 0x5c(%rsp), %rsi
incq %rsi
callq 0x3230
xorl %eax, %eax
addq $0x198, %rsp            # imm = 0x198
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
jmp 0x597b
jmp 0x59e5
jmp 0x597b
jmp 0x59e5
jmp 0x597b
jmp 0x59e5
movq %rax, %r15
movq 0x20(%rsp), %rdi
cmpq %r13, %rdi
jne 0x59d4
jmp 0x59e8
jmp 0x59e5
movq %rax, %r15
movq 0x8c(%rsp), %rdi
leaq 0x9c(%rsp), %rax
cmpq %rax, %rdi
je 0x5a93
movq 0x9c(%rsp), %rsi
incq %rsi
callq 0x3230
jmp 0x5a93
jmp 0x59bf
movq %rax, %r15
jmp 0x5a93
movq %rax, %r15
movq 0x20(%rsp), %rdi
cmpq %rbx, %rdi
je 0x59e8
movq 0x30(%rsp), %rsi
incq %rsi
callq 0x3230
jmp 0x59e8
jmp 0x59e5
movq %rax, %r15
leaq 0x88(%rsp), %rdi
callq 0x8f16
jmp 0x5a8e
jmp 0x5a61
jmp 0x5a66
jmp 0x5a61
jmp 0x5a1c
movq %rax, %r15
movq 0x16c(%rsp), %rdi
cmpq %rbp, %rdi
je 0x5a40
movq 0x17c(%rsp), %rsi
jmp 0x5a38
movq %rax, %r15
jmp 0x5a40
movq %rax, %r15
movq 0x20(%rsp), %rdi
leaq 0x30(%rsp), %rax
cmpq %rax, %rdi
je 0x5a40
movq 0x30(%rsp), %rsi
incq %rsi
callq 0x3230
movq 0x8c(%rsp), %rdi
leaq 0x9c(%rsp), %rax
cmpq %rax, %rdi
je 0x5a8e
movq 0x9c(%rsp), %rsi
jmp 0x5a86
jmp 0x5a61
movq %rax, %r15
jmp 0x5a8e
movq %rax, %r15
movq 0x88(%rsp), %rdi
leaq 0x98(%rsp), %rax
cmpq %rax, %rdi
je 0x5a8e
movq 0x98(%rsp), %rsi
incq %rsi
callq 0x3230
leaq 0x5c(%rsp), %r14
movq 0x4c(%rsp), %rdi
cmpq %r14, %rdi
je 0x5aaa
movq 0x5c(%rsp), %rsi
incq %rsi
callq 0x3230
movq %r15, %rdi
callq 0x3470