// File: 4n6ist[P]usn_analytics/lib/usnjrnl.cpp
// Function: UsnJrnl::GetHistoricalFileName(historical_dir, unsigned char)
historical_dir UsnJrnl::GetHistoricalFileName(historical_dir hdir, uint8_t i) {
  uint32_t count;
  
  if(i == 31) // prevent from infinite loop
    return hdir;
  count = dir_table.count(hdir.pid);  
  if (hdir.pid == 5) { // reach root directory
    hdir.name = "\\" + hdir.name;
    return hdir;
  }
  else if (count == 0) { // parent directory not found
    hdir.name = hdir.name;
    return hdir;
  }
  else if (count == 1) { // unique parent directory found
    auto itr = dir_table.find(hdir.pid);    
    hdir.name = itr->second.name + hdir.name;
    hdir.pid = itr->second.pid;
    i++;
    return GetHistoricalFileName(hdir, i);
  } 
  else { // multiple parent directory found
    int64_t diff = INT64_MAX;
    uint32_t pid = 0;
    string pname = "";
    auto itr = dir_table.equal_range(hdir.pid);
    for (auto iterator = itr.first; iterator != itr.second; iterator++) {
//      if (hdir.usn - iterator->second.usn > 0) {
        if (abs(int64_t(hdir.usn - iterator->second.usn)) < diff) {
          diff = hdir.usn - iterator->second.usn;
          pname = iterator->second.name;
          pid = iterator->second.pid;          
        }         
    }
    hdir.name = pname + hdir.name;
    hdir.pid = pid;
    i++;
    return GetHistoricalFileName(hdir, i);
  }  
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x1d0, %rsp            # imm = 0x1D0
movq %rdx, -0x170(%rbp)
movq %rdi, -0x168(%rbp)
movb %cl, %al
movq %rdi, %rcx
movq %rcx, -0x160(%rbp)
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movb %al, -0x19(%rbp)
movq -0x10(%rbp), %rax
movq %rax, -0x158(%rbp)
movzbl -0x19(%rbp), %eax
cmpl $0x1f, %eax
jne 0x62d0
movq -0x170(%rbp), %rsi
movq -0x168(%rbp), %rdi
callq 0xb7e0
jmp 0x672c
movq -0x170(%rbp), %rsi
movq -0x158(%rbp), %rdi
addq $0x98, %rdi
addq $0x20, %rsi
callq 0xb6c0
movq %rax, %rcx
movq -0x170(%rbp), %rax
movl %ecx, -0x20(%rbp)
cmpl $0x5, 0x20(%rax)
jne 0x6349
movq -0x170(%rbp), %rdx
leaq -0x40(%rbp), %rdi
leaq 0x15e8d(%rip), %rsi     # 0x1c1a0
callq 0xac80
movq -0x170(%rbp), %rdi
leaq -0x40(%rbp), %rsi
callq 0x3450
leaq -0x40(%rbp), %rdi
callq 0x31d0
movq -0x168(%rbp), %rdi
movq -0x170(%rbp), %rsi
callq 0xb7e0
jmp 0x672c
cmpl $0x0, -0x20(%rbp)
jne 0x6376
movq -0x170(%rbp), %rsi
movq %rsi, %rdi
callq 0x3050
movq -0x168(%rbp), %rdi
movq -0x170(%rbp), %rsi
callq 0xb7e0
jmp 0x672c
cmpl $0x1, -0x20(%rbp)
jne 0x6477
movq -0x158(%rbp), %rdi
movq -0x170(%rbp), %rsi
addq $0x98, %rdi
addq $0x20, %rsi
callq 0xb6f0
movq %rax, -0x48(%rbp)
leaq -0x48(%rbp), %rdi
movq %rdi, -0x180(%rbp)
callq 0xb720
movq -0x170(%rbp), %rdx
movq %rax, %rsi
addq $0x4, %rsi
leaq -0x68(%rbp), %rdi
movq %rdi, -0x188(%rbp)
callq 0xb820
movq -0x188(%rbp), %rsi
movq -0x170(%rbp), %rdi
callq 0x3450
movq -0x188(%rbp), %rdi
callq 0x31d0
movq -0x180(%rbp), %rdi
callq 0xb720
movq -0x170(%rbp), %rsi
movl 0x24(%rax), %eax
movl %eax, 0x20(%rsi)
movb -0x19(%rbp), %al
incb %al
movb %al, -0x19(%rbp)
leaq -0x94(%rbp), %rdi
movq %rdi, -0x178(%rbp)
callq 0xb590
movq -0x168(%rbp), %rdi
movq -0x158(%rbp), %rsi
movq -0x178(%rbp), %rdx
movzbl -0x19(%rbp), %ecx
callq 0x6270
jmp 0x6443
leaq -0x94(%rbp), %rdi
callq 0xb610
jmp 0x672c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0xa0(%rbp)
movl %eax, -0xa4(%rbp)
leaq -0x94(%rbp), %rdi
callq 0xb610
jmp 0x673c
movabsq $0x7fffffffffffffff, %rax # imm = 0x7FFFFFFFFFFFFFFF
movq %rax, -0xb0(%rbp)
movl $0x0, -0xb4(%rbp)
leaq -0xd9(%rbp), %rdi
movq %rdi, -0x190(%rbp)
callq 0x35d0
movq -0x190(%rbp), %rdx
leaq 0x15e6a(%rip), %rsi     # 0x1c31d
leaq -0xd8(%rbp), %rdi
callq 0xa400
jmp 0x64c1
leaq -0xd9(%rbp), %rdi
callq 0x33c0
movq -0x158(%rbp), %rdi
movq -0x170(%rbp), %rsi
addq $0x98, %rdi
addq $0x20, %rsi
callq 0xb740
movq %rdx, -0x1a0(%rbp)
movq %rax, -0x198(%rbp)
jmp 0x64fb
movq -0x1a0(%rbp), %rax
movq -0x198(%rbp), %rcx
movq %rcx, -0xf0(%rbp)
movq %rax, -0xe8(%rbp)
movq -0xf0(%rbp), %rax
movq %rax, -0xf8(%rbp)
leaq -0xf0(%rbp), %rsi
addq $0x8, %rsi
leaq -0xf8(%rbp), %rdi
callq 0xb500
testb $0x1, %al
jne 0x6545
jmp 0x665e
movq -0x170(%rbp), %rax
movq 0x24(%rax), %rax
movq %rax, -0x1b0(%rbp)
leaq -0xf8(%rbp), %rdi
callq 0xb720
movq -0x1b0(%rbp), %rdi
movq 0x28(%rax), %rax
subq %rax, %rdi
callq 0xb780
movq %rax, -0x1a8(%rbp)
jmp 0x657f
movq -0x1a8(%rbp), %rax
cmpq -0xb0(%rbp), %rax
jge 0x6642
movq -0x170(%rbp), %rax
movq 0x24(%rax), %rax
movq %rax, -0x1b8(%rbp)
leaq -0xf8(%rbp), %rdi
movq %rdi, -0x1c0(%rbp)
callq 0xb720
movq -0x1c0(%rbp), %rdi
movq %rax, %rcx
movq -0x1b8(%rbp), %rax
movq 0x28(%rcx), %rcx
subq %rcx, %rax
movq %rax, -0xb0(%rbp)
callq 0xb720
movq %rax, %rsi
addq $0x4, %rsi
leaq -0xd8(%rbp), %rdi
callq 0x3050
jmp 0x65f1
leaq -0xf8(%rbp), %rdi
callq 0xb720
movl 0x24(%rax), %eax
movl %eax, -0xb4(%rbp)
jmp 0x6642
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0xa0(%rbp)
movl %eax, -0xa4(%rbp)
leaq -0xd9(%rbp), %rdi
callq 0x33c0
jmp 0x673c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0xa0(%rbp)
movl %eax, -0xa4(%rbp)
jmp 0x671e
jmp 0x6644
leaq -0xf8(%rbp), %rdi
xorl %esi, %esi
callq 0xb7a0
movq %rax, -0x100(%rbp)
jmp 0x6525
movq -0x170(%rbp), %rdx
leaq -0x120(%rbp), %rdi
leaq -0xd8(%rbp), %rsi
callq 0xb820
jmp 0x667a
movq -0x170(%rbp), %rdi
leaq -0x120(%rbp), %rsi
movq %rsi, -0x1c8(%rbp)
callq 0x3450
movq -0x1c8(%rbp), %rdi
callq 0x31d0
movq -0x170(%rbp), %rsi
movl -0xb4(%rbp), %eax
movl %eax, 0x20(%rsi)
movb -0x19(%rbp), %al
incb %al
movb %al, -0x19(%rbp)
leaq -0x14c(%rbp), %rdi
callq 0xb590
jmp 0x66c6
movq -0x158(%rbp), %rsi
movq -0x168(%rbp), %rdi
movzbl -0x19(%rbp), %ecx
leaq -0x14c(%rbp), %rdx
callq 0x6270
jmp 0x66e6
leaq -0x14c(%rbp), %rdi
callq 0xb610
leaq -0xd8(%rbp), %rdi
callq 0x31d0
jmp 0x672c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0xa0(%rbp)
movl %eax, -0xa4(%rbp)
leaq -0x14c(%rbp), %rdi
callq 0xb610
leaq -0xd8(%rbp), %rdi
callq 0x31d0
jmp 0x673c
movq -0x160(%rbp), %rax
addq $0x1d0, %rsp            # imm = 0x1D0
popq %rbp
retq
movq -0xa0(%rbp), %rdi
callq 0x35c0
nopl (%rax,%rax)