Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis.
cseg04:3044 loc_105D4: ; CODE XREF: cseg04:2F10↑j
cseg04:3044 push 0
cseg04:3046 push 34h ; '4'
cseg04:3048 les bx, ppMalloc
cseg04:304C push es
cseg04:304D push bx
cseg04:304E les bx, es:[bx]
cseg04:3051 call dword ptr es:[bx+0Ch]
cseg04:3055 add sp, 8
cseg04:3058 mov si, ax
cseg04:305A mov [bp-6], dx
cseg04:305D or dx, ax
cseg04:305F jnz short loc_105F8
ppMalloc section:
eg70:3612 ppMalloc dd 0 ; DATA XREF: cseg04:3048↑r
dseg70:3612 ; sub_145C0+24↑r ...
dseg70:3616 ; ATOM word_10CA26
dseg70:3616 word_10CA26 dw 0 ; DATA XREF: sub_4637E:loc_463B1↑r
dseg70:3616 ; sub_4637E+3A↑r ...
dseg70:3618 word_10CA28 dw 0 ; DATA XREF: sub_CE2A+1↑o
dseg70:3618 ; cseg03:2F9C↑o ...
dseg70:361A db 0
dseg70:361B db 0
dseg70:361C db 0
dseg70:361D db 0
dseg70:361E db 0
dseg70:361F db 0
dseg70:3620 db 0
dseg70:3621 db 0
dseg70:3622 db 0
dseg70:3623 db 0
dseg70:3624 db 0
dseg70:3625 db 0
dseg70:3626 unk_10CA36 db 0 ; DATA XREF: sub_CE2A+A↑o
dseg70:3626 ; cseg03:2F93↑o ...
dseg70:3627 db 0
dseg70:3628 db 0
dseg70:3629 db 0
dseg70:362A db 0
dseg70:362B db 0
dseg70:362C db 0
dseg70:362D db 0
dseg70:362E db 0
dseg70:362F db 0
dseg70:3630 db 0
dseg70:3631 db 0
dseg70:3632 dw 0