For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the function. For example, I notice IDA translates most function calls into the following two formats.
But sometimes the format does not use a function name. The following example includes the code leading up to the line in question. The third line of code seem to be "missing" the function name. (The comments are my own.)
mov rcx, [rsp+128h+var_D8] // reg CX gets the address at stack pointer+128h+var_D8 bytes mov r8, [rcx] // the address at reg CX is stored to reg r8 call qword ptr [r8 + 18h] // at address rax+18h, call function defined by qword bytes
My questions are as follows:
How do I make the connection between
call qword ptr <address>and a function in the disassembly?
I understand that IDA cannot use a function name here since it does not know the value stored at the register R8... so what causes this? Was there a certain syntax or convention used by the developer? In other words, did the developer call the function
WinSqmAddToStreamin a different manner than the function at