user: Demonstrate the C code that generates the assembly output below:

```asm
<variable_substitute>:
  endbr64
  push   %rbp
  mov    %rsp,%rbp
  sub    $0x150,%rsp
  mov    %rdi,-0x138(%rbp)
  mov    %rsi,-0x140(%rbp)
  mov    %edx,-0x144(%rbp)
  mov    %fs:0x28,%rax
  mov    %rax,-0x8(%rbp)
  xor    %eax,%eax
  jmp    L70
L24:
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  cmp    $0x24,%al
  jne    L180
  addq   $0x1,-0x138(%rbp)
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  cmp    $0x24,%al
  je     L180
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  cmp    $0x7b,%al
  jne    L82
  addq   $0x1,-0x138(%rbp)
  mov    -0x138(%rbp),%rax
  mov    %rax,-0x120(%rbp)
  jmp    L89
L174:
  addq   $0x1,-0x138(%rbp)
L89:
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  test   %al,%al
  je     L112
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  cmp    $0x7d,%al
  jne    L174
  jmp    L112
L82:
  mov    -0x138(%rbp),%rax
  mov    %rax,-0x120(%rbp)
  jmp    L126
L3:
  addq   $0x1,-0x138(%rbp)
L126:
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  test   %al,%al
  je     L112
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  movsbl %al,%eax
  mov    %eax,%edi
  call   <isalnum@plt>
  test   %rax,%rax
  jne    L3
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  cmp    $0x5f,%al
  je     L3
L112:
  mov    -0x138(%rbp),%rax
  sub    -0x120(%rbp),%rax
  mov    $0xff,%edx
  cmp    %rdx,%rax
  cmovg  %rdx,%rax
  mov    %eax,-0x124(%rbp)
  mov    -0x124(%rbp),%edx
  mov    -0x120(%rbp),%rcx
  lea    -0x110(%rbp),%rax
  mov    %rcx,%rsi
  mov    %rax,%rdi
  call   <strncpy@plt>
  mov    -0x124(%rbp),%eax
  movb   $0x0,-0x110(%rbp,%rax,1)
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  cmp    $0x7d,%al
  jne    L54
  addq   $0x1,-0x138(%rbp)
L54:
  lea    -0x110(%rbp),%rax
  mov    %rax,%rdi
  call   <getenv@plt>
  mov    %rax,-0x118(%rbp)
  cmpq   $0x0,-0x118(%rbp)
  je     L36
  mov    -0x118(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  mov    %eax,-0x124(%rbp)
  mov    -0x124(%rbp),%eax
  cmp    -0x144(%rbp),%eax
  jb     L80
  mov    -0x144(%rbp),%eax
  sub    $0x1,%eax
  mov    %eax,-0x124(%rbp)
L80:
  mov    -0x124(%rbp),%edx
  mov    -0x118(%rbp),%rcx
  mov    -0x140(%rbp),%rax
  mov    %rcx,%rsi
  mov    %rax,%rdi
  call   <strncpy@plt>
  mov    -0x124(%rbp),%eax
  add    %rax,-0x140(%rbp)
  mov    -0x124(%rbp),%eax
  sub    %eax,-0x144(%rbp)
L36:
  nop
  jmp    L70
L180:
  mov    -0x138(%rbp),%rdx
  lea    0x1(%rdx),%rax
  mov    %rax,-0x138(%rbp)
  mov    -0x140(%rbp),%rax
  lea    0x1(%rax),%rcx
  mov    %rcx,-0x140(%rbp)
  movzbl (%rdx),%edx
  mov    %dl,(%rax)
  subl   $0x1,-0x144(%rbp)
L70:
  mov    -0x138(%rbp),%rax
  movzbl (%rax),%eax
  test   %al,%al
  je     L184
  cmpl   $0x1,-0x144(%rbp)
  ja     L24
L184:
  mov    -0x140(%rbp),%rax
  movb   $0x0,(%rax)
  nop
  mov    -0x8(%rbp),%rax
  sub    %fs:0x28,%rax
  je     L115
  call   <__stack_chk_fail@plt>
L115:
  leave
  ret
```

assistant: ```c
void variable_substitute(const char *s, char *dest, unsigned int n) {
  while (*s && n > 1) {
    if (*s == '$') {
      s++;
      if (*s != '$') {
        char buf[256];
        const char *a, *var;
        unsigned int len;
        if (*s == '{') {
          s++;
          a = s;
          while (*s && *s != '}')
            s++;
        } else {
          a = s;
          while (*s && (isalnum((int)*s) || *s == '_'))
            s++;
        }
        len = (s - a > 255) ? 255 : (s - a);
        strncpy(buf, a, len);
        buf[len] = '\0';
        if (*s == '}')
          s++;
        var = getenv(buf);
        if (var) {
          len = strlen(var);
          if (len >= n)
            len = n - 1;
          strncpy(dest, var, len);
          dest += len;
          n -= len;
        }
        continue;
      }
    }
    *dest++ = *s++;
    n--;
  }
  *dest = '\0';
}
```