user: Please show me the C implementation that matches the assembly code listed below:

```asm
<expand_envars>:
  endbr64
  push   %rbp
  mov    %rsp,%rbp
  push   %r15
  mov    %rdi,%r15
  push   %r14
  push   %r13
  push   %r12
  push   %rbx
  sub    $0x48,%rsp
  mov    %fs:0x28,%rax
  mov    %rax,-0x38(%rbp)
  xor    %eax,%eax
  call   <strlen@plt>
  mov    $0x1,%edi
  add    %eax,%eax
  mov    %eax,%esi
  mov    %eax,-0x4c(%rbp)
  call   <calloc@plt>
  mov    %rax,-0x60(%rbp)
  movzbl (%r15),%eax
  test   %al,%al
  je     L247
  xor    %ebx,%ebx
  jmp    L199
  nopl   0x0(%rax)
L46:
  movzbl (%r15),%eax
  mov    -0x60(%rbp),%rcx
  mov    -0x58(%rbp),%r15
  mov    %al,(%rcx,%r9,1)
  movslq %ebx,%rax
  movb   $0x0,(%rcx,%rax,1)
L175:
  movzbl (%r15),%eax
  test   %al,%al
  je     L70
L199:
  lea    0x1(%r15),%rdx
  mov    %rdx,-0x58(%rbp)
  cmp    $0x24,%al
  je     L21
L234:
  movslq %ebx,%r9
L119:
  add    $0x1,%ebx
  cmp    -0x4c(%rbp),%ebx
  jl     L46
  shll   -0x4c(%rbp)
  mov    -0x60(%rbp),%rdi
  mov    -0x4c(%rbp),%esi
  mov    %r9,-0x48(%rbp)
  call   <realloc@plt>
  mov    -0x48(%rbp),%r9
  mov    %rax,-0x60(%rbp)
  jmp    L46
  nop
L21:
  movsbl 0x1(%r15),%edi
  cmp    $0x7b,%dil
  je     L309
  mov    -0x58(%rbp),%rax
  movl   $0x0,-0x50(%rbp)
  xor    %r13d,%r13d
  xor    %r14d,%r14d
  mov    %rax,-0x48(%rbp)
  mov    $0x1,%eax
  test   %dil,%dil
  je     L120
L44:
  xor    %r14d,%r14d
  nopl   0x0(%rax)
L76:
  mov    %r14d,%r12d
  mov    %r14d,%r13d
  call   <isalnum@plt>
  test   %rax,%rax
  jne    L198
  mov    -0x48(%rbp),%rax
  movzbl (%rax,%r14,1),%eax
  cmp    $0x5f,%al
  jne    L212
L198:
  mov    -0x48(%rbp),%rax
  add    $0x1,%r14
  lea    0x1(%r12),%r13d
  movsbl (%rax,%r14,1),%edi
  test   %dil,%dil
  jne    L76
  mov    -0x50(%rbp),%eax
  movslq %ebx,%r9
  test   %eax,%eax
  jne    L119
  lea    0x2(%r12),%eax
  cltq
L120:
  add    $0xf,%rax
  mov    %rsp,%rdi
  mov    %rsp,%r12
  mov    %rax,%rsi
  and    $0xfffffffffffff000,%rax
  sub    %rax,%rdi
  and    $0xfffffffffffffff0,%rsi
  cmp    %rdi,%rsp
  je     L79
L202:
  sub    $0x1000,%rsp
  orq    $0x0,0xff8(%rsp)
  cmp    %rdi,%rsp
  jne    L202
L79:
  and    $0xfff,%esi
  sub    %rsi,%rsp
  test   %rsi,%rsi
  jne    L229
L192:
  mov    -0x48(%rbp),%rsi
  mov    %rsp,%r9
  mov    %r13d,%edx
  mov    %rsp,%rdi
  mov    %r9,-0x68(%rbp)
  call   <strncpy@plt>
  movslq %r13d,%rdx
  lea    D0(%rip),%rsi
  mov    %rsp,%rdi
  movb   $0x0,(%rsp,%rdx,1)
  call   <strcmp@plt>
  mov    -0x68(%rbp),%r9
  test   %rax,%rax
  je     L109
  movzbl (%rsp),%eax
  sub    $0x30,%eax
  cmp    $0x9,%al
  jbe    L109
  movslq %ebx,%r9
L111:
  mov    %r12,%rsp
  jmp    L119
  cs nopw 0x0(%rax,%rax,1)
L70:
  movslq %ebx,%rbx
  add    -0x60(%rbp),%rbx
L211:
  movb   $0x0,(%rbx)
  mov    -0x38(%rbp),%rax
  sub    %fs:0x28,%rax
  jne    L248
  mov    -0x60(%rbp),%rax
  lea    -0x28(%rbp),%rsp
  pop    %rbx
  pop    %r12
  pop    %r13
  pop    %r14
  pop    %r15
  pop    %rbp
  ret
L109:
  mov    %r9,%rdi
  call   <getenv@plt>
  mov    %rax,%r13
  test   %rax,%rax
  jne    L214
  mov    -0x60(%rbp),%rax
  movslq %ebx,%r9
  movb   $0x0,(%rax,%r9,1)
  jmp    L111
  xchg   %ax,%ax
L309:
  movsbl 0x2(%r15),%edi
  lea    0x2(%r15),%rax
  movl   $0x1,-0x50(%rbp)
  mov    %rax,-0x48(%rbp)
  test   %dil,%dil
  jne    L44
  jmp    L234
  nopw   0x0(%rax,%rax,1)
L212:
  mov    -0x50(%rbp),%edx
  test   %edx,%edx
  je     L102
  cmp    $0x7d,%al
  jne    L234
L102:
  lea    0x1(%r13),%eax
  cltq
  jmp    L120
L229:
  orq    $0x0,-0x8(%rsp,%rsi,1)
  jmp    L192
  nopl   (%rax)
L214:
  mov    %rax,%rdi
  call   <strlen@plt>
  add    %eax,%ebx
  cmp    -0x4c(%rbp),%ebx
  jge    L298
L243:
  mov    -0x60(%rbp),%rdi
  mov    %r13,%rsi
  call   <strcat@plt>
  mov    -0x50(%rbp),%eax
  mov    %r12,%rsp
  add    %eax,%eax
  cltq
  lea    0x1(%r14,%rax,1),%rax
  add    %rax,%r15
  jmp    L175
L247:
  mov    -0x60(%rbp),%rbx
  jmp    L211
L298:
  mov    -0x4c(%rbp),%esi
  mov    -0x60(%rbp),%rdi
  lea    (%rax,%rsi,2),%eax
  mov    %eax,%esi
  mov    %eax,-0x4c(%rbp)
  call   <realloc@plt>
  mov    %rax,-0x60(%rbp)
  jmp    L243
L248:
  call   <__stack_chk_fail@plt>
```

tool_calls: name: extract_symbolic_data
arguments: tag: D0
datatype: string

tool: D0: ONDIRWD

assistant: ```c
char *expand_envars(const char *in) {
  int inlen = strlen(in), outmax = inlen * 2, outlen = 0;
  char *out = calloc(1, outmax);
  while (*in) {
    const char *mark = in;
    if (*in == '$') {
      int bracketed = 0, varlen = 0;
      const char *varstart;
      ++in;
      if (*in == '{') {
        ++in;
        bracketed = 1;
      }
      varstart = in;
      while (in[varlen] && (isalnum(in[varlen]) || in[varlen] == '_'))
        ++varlen;
      if (bracketed && in[varlen] != '}')
        in = mark;
      else {
        char var[varlen + 1];
        const char *val;
        strncpy(var, varstart, varlen);
        var[varlen] = 0;
        if (strcmp(var, "ONDIRWD") && (var[0] < '0' || var[0] > '9')) {
          in = mark;
        } else {
          val = getenv(var);
          if (val) {
            int vallen = strlen(val);
            if (outlen + vallen >= outmax) {
              outmax = outmax * 2 + vallen;
              out = realloc(out, outmax);
            }
            strcat(out, val);
            outlen += vallen;
            in = mark + varlen + bracketed * 2 + 1;
            continue;
          } else {
            in = mark;
            out[outlen] = 0;
          }
        }
      }
    }
    if (outlen + 1 >= outmax) {
      outmax *= 2;
      out = realloc(out, outmax);
    }
    out[outlen++] = *in++;
    out[outlen] = 0;
  }
  out[outlen] = 0;
  return out;
}
```