user: 请从给定的汇编指令推导出C源代码:

```asm
<substr>:
  endbr64
  push   %rbp
  mov    %rsp,%rbp
  push   %rbx
  sub    $0x48,%rsp
  mov    %rdi,-0x38(%rbp)
  mov    %rsi,-0x40(%rbp)
  mov    %rdx,-0x48(%rbp)
  mov    -0x48(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  mov    %eax,-0x24(%rbp)
  mov    -0x40(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  mov    %eax,-0x20(%rbp)
  mov    -0x24(%rbp),%eax
  cmp    -0x20(%rbp),%eax
  jle    L26
  mov    -0x24(%rbp),%eax
  sub    -0x20(%rbp),%eax
  mov    %eax,%ebx
  mov    -0x38(%rbp),%rax
  mov    (%rax),%rax
  mov    -0x40(%rbp),%rdx
  mov    %rdx,%rsi
  mov    %rax,%rdi
  call   <strnoc@plt>
  imul   %eax,%ebx
  mov    -0x38(%rbp),%rax
  mov    (%rax),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  add    %ebx,%eax
  add    $0x1,%eax
  mov    %eax,-0x1c(%rbp)
  mov    -0x38(%rbp),%rax
  mov    (%rax),%rax
  mov    -0x1c(%rbp),%edx
  mov    %edx,%esi
  mov    %rax,%rdi
  call   <realloc@plt>
  mov    -0x38(%rbp),%rdx
  mov    %rax,(%rdx)
  mov    -0x38(%rbp),%rax
  mov    (%rax),%rax
  mov    %rax,-0x18(%rbp)
  jmp    L32
L0:
  mov    -0x20(%rbp),%eax
  movslq %eax,%rdx
  mov    -0x18(%rbp),%rax
  add    %rdx,%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  lea    0x1(%rax),%edx
  mov    -0x20(%rbp),%eax
  movslq %eax,%rcx
  mov    -0x18(%rbp),%rax
  add    %rax,%rcx
  mov    -0x24(%rbp),%eax
  movslq %eax,%rsi
  mov    -0x18(%rbp),%rax
  add    %rsi,%rax
  mov    %rcx,%rsi
  mov    %rax,%rdi
  call   <memmove@plt>
  mov    -0x24(%rbp),%edx
  mov    -0x48(%rbp),%rcx
  mov    -0x18(%rbp),%rax
  mov    %rcx,%rsi
  mov    %rax,%rdi
  call   <memcpy@plt>
  addq   $0x1,-0x18(%rbp)
L32:
  mov    -0x40(%rbp),%rdx
  mov    -0x18(%rbp),%rax
  mov    %rdx,%rsi
  mov    %rax,%rdi
  call   <strstr@plt>
  mov    %rax,-0x18(%rbp)
  cmpq   $0x0,-0x18(%rbp)
  jne    L0
  jmp    L42
L26:
  mov    -0x38(%rbp),%rax
  mov    (%rax),%rax
  mov    %rax,-0x18(%rbp)
  jmp    L30
L1:
  mov    -0x24(%rbp),%edx
  mov    -0x48(%rbp),%rcx
  mov    -0x18(%rbp),%rax
  mov    %rcx,%rsi
  mov    %rax,%rdi
  call   <memcpy@plt>
  mov    -0x20(%rbp),%eax
  movslq %eax,%rdx
  mov    -0x18(%rbp),%rax
  add    %rdx,%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  lea    0x1(%rax),%edx
  mov    -0x20(%rbp),%eax
  movslq %eax,%rcx
  mov    -0x18(%rbp),%rax
  add    %rax,%rcx
  mov    -0x24(%rbp),%eax
  movslq %eax,%rsi
  mov    -0x18(%rbp),%rax
  add    %rsi,%rax
  mov    %rcx,%rsi
  mov    %rax,%rdi
  call   <memmove@plt>
L30:
  mov    -0x40(%rbp),%rdx
  mov    -0x18(%rbp),%rax
  mov    %rdx,%rsi
  mov    %rax,%rdi
  call   <strstr@plt>
  mov    %rax,-0x18(%rbp)
  cmpq   $0x0,-0x18(%rbp)
  jne    L1
L42:
  nop
  mov    -0x8(%rbp),%rbx
  leave
  ret
```

assistant: ```c
void substr(char **text, const char *sub, const char *repl) {
  int l_repl, l_sub;
  l_repl = strlen(repl);
  l_sub = strlen(sub);
  char *match;
  if (l_repl > l_sub) {
    int nsize = (l_repl - l_sub) * strnoc(*text, sub) + strlen(*text) + 1;
    *text = realloc(*text, sizeof(char) * nsize);
    match = *text;
    while ((match = strstr(match, sub)) != NULL) {
      memmove(match + l_repl, match + l_sub, strlen(match + l_sub) + 1);
      memcpy(match, repl, l_repl);
      match += 1;
    }
  } else {
    match = *text;
    while ((match = strstr(match, sub)) != NULL) {
      memcpy(match, repl, l_repl);
      memmove(match + l_repl, match + l_sub, strlen(match + l_sub) + 1);
    }
  }
}
```