user: 请从给定的汇编指令推导出C源代码:

```asm
<str_replace>:
  endbr64
  push   %rbp
  mov    %rsp,%rbp
  push   %r13
  push   %r12
  push   %rbx
  sub    $0x48,%rsp
  mov    %rdi,-0x48(%rbp)
  mov    %rsi,-0x50(%rbp)
  mov    %rdx,-0x58(%rbp)
  movq   $0x0,-0x30(%rbp)
  movq   $0x0,-0x38(%rbp)
  movq   $0x0,-0x28(%rbp)
  cmpq   $0x0,-0x50(%rbp)
  je     L39
  cmpq   $0x0,-0x58(%rbp)
  jne    L34
L39:
  mov    -0x48(%rbp),%rax
  mov    %rax,%rdi
  call   <strdup@plt>
  jmp    L62
L34:
  mov    -0x48(%rbp),%rax
  mov    %rax,%rdi
  call   <strdup@plt>
  mov    %rax,-0x38(%rbp)
  jmp    L55
L4:
  mov    -0x38(%rbp),%rax
  mov    %rax,-0x28(%rbp)
  mov    -0x28(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  mov    %eax,%ebx
  mov    -0x50(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  sub    %eax,%ebx
  mov    -0x58(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  add    %ebx,%eax
  add    $0x1,%eax
  mov    %eax,%edi
  call   <malloc@plt>
  mov    %rax,-0x38(%rbp)
  cmpq   $0x0,-0x38(%rbp)
  jne    L52
  mov    -0x28(%rbp),%rax
  mov    %rax,%rdi
  call   <free@plt>
  mov    $0x0,%eax
  jmp    L62
L52:
  mov    -0x30(%rbp),%rax
  sub    -0x28(%rbp),%rax
  mov    %eax,%edx
  mov    -0x28(%rbp),%rcx
  mov    -0x38(%rbp),%rax
  mov    %rcx,%rsi
  mov    %rax,%rdi
  call   <memcpy@plt>
  mov    -0x58(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  mov    %eax,%edx
  mov    -0x30(%rbp),%rax
  sub    -0x28(%rbp),%rax
  mov    %rax,%rcx
  mov    -0x38(%rbp),%rax
  add    %rax,%rcx
  mov    -0x58(%rbp),%rax
  mov    %rax,%rsi
  mov    %rcx,%rdi
  call   <memcpy@plt>
  mov    -0x28(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  mov    %eax,%ebx
  mov    -0x50(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  mov    %eax,%edx
  mov    %ebx,%eax
  sub    %edx,%eax
  mov    %eax,%edx
  mov    -0x30(%rbp),%rax
  sub    -0x28(%rbp),%rax
  mov    %eax,%ecx
  mov    %edx,%eax
  sub    %ecx,%eax
  mov    %eax,%r12d
  mov    -0x50(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  movslq %eax,%rdx
  mov    -0x30(%rbp),%rax
  lea    (%rdx,%rax,1),%rbx
  mov    -0x30(%rbp),%rax
  sub    -0x28(%rbp),%rax
  mov    %rax,%r13
  mov    -0x58(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  cltq
  lea    0x0(%r13,%rax,1),%rdx
  mov    -0x38(%rbp),%rax
  add    %rdx,%rax
  mov    %r12d,%edx
  mov    %rbx,%rsi
  mov    %rax,%rdi
  call   <memcpy@plt>
  mov    -0x28(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  movslq %eax,%rbx
  mov    -0x50(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  cltq
  sub    %rax,%rbx
  mov    -0x58(%rbp),%rax
  mov    %rax,%rdi
  call   <strlen@plt>
  cltq
  lea    (%rbx,%rax,1),%rdx
  mov    -0x38(%rbp),%rax
  add    %rdx,%rax
  mov    $0x1,%edx
  mov    $0x0,%esi
  mov    %rax,%rdi
  call   <memset@plt>
  mov    -0x28(%rbp),%rax
  mov    %rax,%rdi
  call   <free@plt>
L55:
  mov    -0x50(%rbp),%rdx
  mov    -0x38(%rbp),%rax
  mov    %rdx,%rsi
  mov    %rax,%rdi
  call   <strstr@plt>
  mov    %rax,-0x30(%rbp)
  cmpq   $0x0,-0x30(%rbp)
  jne    L4
  mov    -0x38(%rbp),%rax
L62:
  add    $0x48,%rsp
  pop    %rbx
  pop    %r12
  pop    %r13
  pop    %rbp
  ret
```

assistant: ```c
char *str_replace(const char *string, const char *substr, const char *replacement) {
  char *tok = NULL;
  char *newstr = NULL;
  char *oldstr = NULL;
  if (substr == NULL || replacement == NULL)
    return strdup(string);
  newstr = strdup(string);
  while ((tok = strstr(newstr, substr))) {
    oldstr = newstr;
    newstr = malloc(strlen(oldstr) - strlen(substr) + strlen(replacement) + 1);
    if (newstr == NULL) {
      free(oldstr);
      return NULL;
    }
    memcpy(newstr, oldstr, tok - oldstr);
    memcpy(newstr + (tok - oldstr), replacement, strlen(replacement));
    memcpy(newstr + (tok - oldstr) + strlen(replacement), tok + strlen(substr), strlen(oldstr) - strlen(substr) - (tok - oldstr));
    memset(newstr + strlen(oldstr) - strlen(substr) + strlen(replacement), 0, 1);
    free(oldstr);
  }
  return newstr;
}
```