How to identify function calls in IDA Pro's disassembly?

Question

I am reverse engineering some code from which IDA has generated the following disassembly. These specific lines of code are just for illustrative purposes. Notice that the third line does not call a specifc function by its name but rather by its address.

mov rcx, [rsp+128h+var_D8]    // reg CX gets the address at stack pointer+128h+var_D8 bytes 
mov r8, [rcx]                 // the address at reg CX is stored to reg r8
call qword ptr [r8 + 18h]     // at address rax+18h, call function defined by qword bytes

I'm interested in determining which function is being called. What mechanisms, tools, tricks, etc. can I use to determine which function in the dissassembly a call qword ptr <address> is referring to? I'm up for trying other disassembler programs.

From an answer to my previous question, this is known as an "indirect call" or (perhaps a "virtual function call"). The disassembly has many of these, so how do I resolve them? In addition, IDA has identified hundreds of functions. How do I go about figuring out which one was actually being called during any given indirect call (or virtual call)?

Answer 1

The easiest way to find out the function in question would probably be by dynamic analysis. You can easily do this by placing a breakpoint on that instruction in a debugger and examining the registers.

A more general solution would probably involve some scripting to record all calls and add that information to the IDA database. Funcap plugin does something similar if not exactly what you are looking for:

This script records function calls (and returns) across an executable using IDA debugger API, along with all the arguments passed. It dumps the info to a text file, and also inserts it into IDA's inline comments. This way, static analysis that usually follows the behavioral runtime analysis when analyzing malware, can be directly fed with runtime info such as decrypted strings returned in function's arguments.