// File: 4n6ist[P]usn_analytics/lib/usnjrnl.cpp
// Function: UsnJrnl::WriteOpenedRecords(char*, bool)
int UsnJrnl::WriteOpenedRecords(char *odname, bool lt) {
  
  vector<UsnOpened> usnopened_set;

  // create usnexecuted_set
  for(int i=0; i < usnmain_set.size(); i++) { 
    if (usnmain_set[i].file_name.size() >= 4 && usnmain_set[i].file_name.find(".lnk", usnmain_set[i].file_name.size()-4) != string::npos) {
      if(usnmain_set[i].reasons_i != (SECURITY|CLOSE) && !(usnmain_set[i].reasons_i & DELETE)) {
        UsnOpened* uo = new UsnOpened();
        uo->StoreRecord(&usnmain_set[i]);
        usnopened_set.push_back(*uo);
        delete uo;
      }
    } else if (usnmain_set[i].reasons_i & (OBJECTID) && !(usnmain_set[i].reasons_i & DELETE)) {
      UsnOpened* uo = new UsnOpened();
      uo->StoreRecord(&usnmain_set[i]);
      usnopened_set.push_back(*uo);
      delete uo;
    }
  }

  map<string, uint16_t> open_name_table; // open_name, open_cnt

  // create open_name table (open_name, open_cnt)
  for(int i=0; i < usnopened_set.size(); i++)
    if(open_name_table.find(usnopened_set[i].file_name) == open_name_table.end())
      open_name_table[usnopened_set[i].file_name] = 1;
    else
      open_name_table[usnopened_set[i].file_name]++;

  // write to report  
  int i=0;
  fprintf(fp_ofreport, "\n[File Open] %lu files (name, count)\n", open_name_table.size());
  for(auto x: open_name_table) {
    fprintf(fp_ofreport, "%s, %d\n", x.first.c_str(), x.second);
    i++;
    if(i > 1024) {
      fprintf(fp_ofreport, "reached 1024 files...skip the rest\n");
      break;
    }
  }
  
  FILE *fp_ofopened;
  string ofopened;
  ofopened = string(odname) + SEP + "usn_analytics_opened.csv";

  if((fp_ofopened = fopen(ofopened.c_str(), "w")) == NULL) {
    perror("Output Records File Error");
    exit(EXIT_FAILURE);
  } 
  
  WriteOpenedHeader(fp_ofopened, lt);
  // write to file
  for(int i=0; i < usnopened_set.size(); i++)
    usnopened_set[i].WriteOpenedRecord(fp_ofopened);

  printf("...Done\n");
  fclose(fp_ofopened);
  return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x230, %rsp            # imm = 0x230
movb %dl, %al
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
andb $0x1, %al
movb %al, -0x11(%rbp)
movq -0x8(%rbp), %rax
movq %rax, -0x188(%rbp)
leaq -0x30(%rbp), %rdi
callq 0xba50
movl $0x0, -0x34(%rbp)
movq -0x188(%rbp), %rdi
movslq -0x34(%rbp), %rax
movq %rax, -0x190(%rbp)
addq $0x50, %rdi
callq 0xaf20
movq %rax, %rcx
movq -0x190(%rbp), %rax
cmpq %rcx, %rax
jae 0x7f32
movq -0x188(%rbp), %rdi
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movq %rax, %rdi
addq $0x3a, %rdi
callq 0x3220
cmpq $0x4, %rax
jb 0x7e19
movq -0x188(%rbp), %rdi
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movq -0x188(%rbp), %rdi
addq $0x3a, %rax
movq %rax, -0x198(%rbp)
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movq %rax, %rdi
addq $0x3a, %rdi
callq 0x3220
movq -0x198(%rbp), %rdi
movq %rax, %rdx
subq $0x4, %rdx
leaq 0x14739(%rip), %rsi     # 0x1c42a
callq 0x3630
cmpq $-0x1, %rax
je 0x7e19
movq -0x188(%rbp), %rdi
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
cmpl $0x80000800, 0x5a(%rax) # imm = 0x80000800
je 0x7e14
movq -0x188(%rbp), %rdi
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movl 0x5a(%rax), %eax
andl $0x200, %eax            # imm = 0x200
cmpl $0x0, %eax
jne 0x7e14
movl $0xa6, %edi
callq 0x3340
movq %rax, -0x1a0(%rbp)
jmp 0x7d59
movq -0x1a0(%rbp), %rdi
callq 0x17310
jmp 0x7d67
movq -0x188(%rbp), %rdi
movq -0x1a0(%rbp), %rax
movq %rax, -0x40(%rbp)
movq -0x40(%rbp), %rax
movq %rax, -0x1a8(%rbp)
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movq -0x1a8(%rbp), %rdi
movq %rax, %rsi
callq 0x17360
jmp 0x7da2
movq -0x40(%rbp), %rsi
leaq -0x30(%rbp), %rdi
callq 0xba70
jmp 0x7db1
movq -0x40(%rbp), %rax
movq %rax, -0x1b0(%rbp)
cmpq $0x0, %rax
je 0x7ddf
movq -0x1b0(%rbp), %rdi
callq 0xbae0
movq -0x1b0(%rbp), %rdi
movl $0xa6, %esi
callq 0x3350
jmp 0x7e14
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
jmp 0x8447
movq -0x1a0(%rbp), %rdi
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
movl $0xa6, %esi
callq 0x3350
jmp 0x8447
jmp 0x7f22
movq -0x188(%rbp), %rdi
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movl 0x5a(%rax), %eax
andl $0x80000, %eax          # imm = 0x80000
cmpl $0x0, %eax
je 0x7f20
movq -0x188(%rbp), %rdi
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movl 0x5a(%rax), %eax
andl $0x200, %eax            # imm = 0x200
cmpl $0x0, %eax
jne 0x7f20
movl $0xa6, %edi
callq 0x3340
movq %rax, -0x1b8(%rbp)
jmp 0x7e76
movq -0x1b8(%rbp), %rdi
callq 0x17310
jmp 0x7e84
movq -0x188(%rbp), %rdi
movq -0x1b8(%rbp), %rax
movq %rax, -0x58(%rbp)
movq -0x58(%rbp), %rax
movq %rax, -0x1c0(%rbp)
addq $0x50, %rdi
movslq -0x34(%rbp), %rsi
callq 0xaf90
movq -0x1c0(%rbp), %rdi
movq %rax, %rsi
callq 0x17360
jmp 0x7ebf
movq -0x58(%rbp), %rsi
leaq -0x30(%rbp), %rdi
callq 0xba70
jmp 0x7ece
movq -0x58(%rbp), %rax
movq %rax, -0x1c8(%rbp)
cmpq $0x0, %rax
je 0x7efc
movq -0x1c8(%rbp), %rdi
callq 0xbae0
movq -0x1c8(%rbp), %rdi
movl $0xa6, %esi
callq 0x3350
jmp 0x7f20
movq -0x1b8(%rbp), %rdi
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
movl $0xa6, %esi
callq 0x3350
jmp 0x8447
jmp 0x7f22
jmp 0x7f24
movl -0x34(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x34(%rbp)
jmp 0x7c45
leaq -0x88(%rbp), %rdi
callq 0xad90
movl $0x0, -0x8c(%rbp)
movslq -0x8c(%rbp), %rax
movq %rax, -0x1d0(%rbp)
leaq -0x30(%rbp), %rdi
callq 0xbb30
movq %rax, %rcx
movq -0x1d0(%rbp), %rax
cmpq %rcx, %rax
jae 0x8076
movslq -0x8c(%rbp), %rsi
leaq -0x30(%rbp), %rdi
callq 0xbb60
movq %rax, %rsi
addq $0x48, %rsi
leaq -0x88(%rbp), %rdi
callq 0xaec0
movq %rax, -0x1d8(%rbp)
jmp 0x7f9e
movq -0x1d8(%rbp), %rax
movq %rax, -0x98(%rbp)
leaq -0x88(%rbp), %rdi
callq 0xaef0
movq %rax, -0xa0(%rbp)
leaq -0x98(%rbp), %rdi
leaq -0xa0(%rbp), %rsi
callq 0xae90
testb $0x1, %al
jne 0x7fd8
jmp 0x8023
movslq -0x8c(%rbp), %rsi
leaq -0x30(%rbp), %rdi
callq 0xbb60
movq %rax, %rsi
addq $0x48, %rsi
leaq -0x88(%rbp), %rdi
callq 0xadb0
movq %rax, -0x1e0(%rbp)
jmp 0x8004
movq -0x1e0(%rbp), %rax
movw $0x1, (%rax)
jmp 0x8060
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
jmp 0x843b
movslq -0x8c(%rbp), %rsi
leaq -0x30(%rbp), %rdi
callq 0xbb60
movq %rax, %rsi
addq $0x48, %rsi
leaq -0x88(%rbp), %rdi
callq 0xadb0
movq %rax, -0x1e8(%rbp)
jmp 0x804f
movq -0x1e8(%rbp), %rax
movw (%rax), %cx
addw $0x1, %cx
movw %cx, (%rax)
jmp 0x8062
movl -0x8c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x8c(%rbp)
jmp 0x7f48
movq -0x188(%rbp), %rax
movl $0x0, -0xa4(%rbp)
movq 0x18(%rax), %rax
movq %rax, -0x1f0(%rbp)
leaq -0x88(%rbp), %rdi
callq 0xb9d0
movq -0x1f0(%rbp), %rdi
movq %rax, %rdx
leaq 0x14380(%rip), %rsi     # 0x1c42f
movb $0x0, %al
callq 0x34d0
leaq -0x88(%rbp), %rax
movq %rax, -0xb0(%rbp)
movq -0xb0(%rbp), %rdi
callq 0xafb0
movq %rax, -0xb8(%rbp)
movq -0xb0(%rbp), %rdi
callq 0xaef0
movq %rax, -0xc0(%rbp)
leaq -0xb8(%rbp), %rdi
leaq -0xc0(%rbp), %rsi
callq 0xafe0
testb $0x1, %al
jne 0x8106
jmp 0x81d7
leaq -0xb8(%rbp), %rdi
callq 0xb010
movq %rax, %rsi
leaq -0xe8(%rbp), %rdi
callq 0xb030
jmp 0x8123
movq -0x188(%rbp), %rax
movq 0x18(%rax), %rax
movq %rax, -0x1f8(%rbp)
leaq -0xe8(%rbp), %rdi
callq 0x3120
movq -0x1f8(%rbp), %rdi
movq %rax, %rdx
movzwl -0xc8(%rbp), %ecx
leaq 0x14292(%rip), %rsi     # 0x1c3eb
movb $0x0, %al
callq 0x34d0
movl -0xa4(%rbp), %eax
addl $0x1, %eax
movl %eax, -0xa4(%rbp)
cmpl $0x400, -0xa4(%rbp)     # imm = 0x400
jle 0x81a0
movq -0x188(%rbp), %rax
movq 0x18(%rax), %rdi
leaq 0x142c8(%rip), %rsi     # 0x1c455
movb $0x0, %al
callq 0x34d0
movl $0x8, -0xec(%rbp)
jmp 0x81aa
movl $0x0, -0xec(%rbp)
leaq -0xe8(%rbp), %rdi
callq 0xb070
movl -0xec(%rbp), %eax
testl %eax, %eax
je 0x81c4
jmp 0x81c2
jmp 0x81d7
jmp 0x81c6
leaq -0xb8(%rbp), %rdi
callq 0xb090
jmp 0x80ea
leaq -0x118(%rbp), %rdi
callq 0x34b0
movq -0x10(%rbp), %rax
movq %rax, -0x208(%rbp)
leaq -0x179(%rbp), %rdi
movq %rdi, -0x200(%rbp)
callq 0x35d0
movq -0x208(%rbp), %rsi
movq -0x200(%rbp), %rdx
leaq -0x178(%rbp), %rdi
callq 0xa400
jmp 0x821d
leaq 0x1f11d(%rip), %rax     # 0x27341
movsbl (%rax), %edx
leaq -0x158(%rbp), %rdi
leaq -0x178(%rbp), %rsi
callq 0xa3b0
jmp 0x823c
leaq 0x14236(%rip), %rdx     # 0x1c479
leaq -0x138(%rbp), %rdi
leaq -0x158(%rbp), %rsi
callq 0xa360
jmp 0x8258
leaq -0x118(%rbp), %rdi
movq %rdi, -0x218(%rbp)
leaq -0x138(%rbp), %rsi
movq %rsi, -0x220(%rbp)
callq 0x3450
movq -0x220(%rbp), %rdi
callq 0x31d0
leaq -0x158(%rbp), %rdi
callq 0x31d0
leaq -0x178(%rbp), %rdi
callq 0x31d0
leaq -0x179(%rbp), %rdi
callq 0x33c0
movq -0x218(%rbp), %rdi
callq 0x3120
movq %rax, %rdi
leaq 0x1486f(%rip), %rsi     # 0x1cb2e
callq 0x3420
movq %rax, -0x210(%rbp)
jmp 0x82cd
movq -0x210(%rbp), %rax
movq %rax, -0xf8(%rbp)
cmpq $0x0, %rax
jne 0x835b
leaq 0x14099(%rip), %rdi     # 0x1c381
callq 0x32a0
jmp 0x82ef
movl $0x1, %edi
callq 0x3440
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
jmp 0x8339
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
jmp 0x832d
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
leaq -0x158(%rbp), %rdi
callq 0x31d0
leaq -0x178(%rbp), %rdi
callq 0x31d0
leaq -0x179(%rbp), %rdi
callq 0x33c0
jmp 0x842f
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x48(%rbp)
movl %eax, -0x4c(%rbp)
jmp 0x842f
movq -0x188(%rbp), %rdi
movq -0xf8(%rbp), %rsi
movzbl -0x11(%rbp), %edx
andl $0x1, %edx
callq 0x7ad0
jmp 0x8377
movl $0x0, -0x180(%rbp)
movslq -0x180(%rbp), %rax
movq %rax, -0x228(%rbp)
leaq -0x30(%rbp), %rdi
callq 0xbb30
movq %rax, %rcx
movq -0x228(%rbp), %rax
cmpq %rcx, %rax
jae 0x83db
movslq -0x180(%rbp), %rsi
leaq -0x30(%rbp), %rdi
callq 0xbb60
movq %rax, %rdi
movq -0xf8(%rbp), %rsi
callq 0x17430
jmp 0x83c8
jmp 0x83ca
movl -0x180(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x180(%rbp)
jmp 0x8381
leaq 0x1402c(%rip), %rdi     # 0x1c40e
xorl %eax, %eax
callq 0x3060
jmp 0x83eb
movq -0xf8(%rbp), %rdi
callq 0x3330
jmp 0x83f9
movl $0x1, -0xec(%rbp)
leaq -0x118(%rbp), %rdi
callq 0x31d0
leaq -0x88(%rbp), %rdi
callq 0xb0c0
leaq -0x30(%rbp), %rdi
callq 0xbb80
xorl %eax, %eax
addq $0x230, %rsp            # imm = 0x230
popq %rbp
retq
leaq -0x118(%rbp), %rdi
callq 0x31d0
leaq -0x88(%rbp), %rdi
callq 0xb0c0
leaq -0x30(%rbp), %rdi
callq 0xbb80
movq -0x48(%rbp), %rdi
callq 0x35c0
nopl (%rax)