Cheat Engine

[predprey]

Branch mapper causes the attached process to lag until it does not respond at all until toggled off so the mappers can't be used for finding calls that get executed when performing some action. Loading address list from disassembler is unreliable and causes exception errors in the attached process. Not sure how to load addresses from a trace if I have no idea where the function I want is and so no where to trace from.

So what do people who use Code Filter usually use it for and you use it?

[Dark Byte]

Enable break on unexpected breakpoints and do a disassembler list and save that list to a textfile

The first few times it'll crash on an invalid bp location, but just edit the list (look at the crash EIP/RIP and look for a 0xcc near here) and load that back (sometimes you can do a continue handled after removing the broken bp address)
After a few times you'll have a list of call's all valid

Or use the tracer, but that's less useful as that usually means you already know where to look

The map also works, but as you have guessed, it's very slow and may take a day or two

And perhaps save the list as a textfile, and then let lua parse over it and make it detect some disassembler mistakes that aren't actually calls (but will require you to add in some extra checks.
e.g:

[predprey]

[Dark Byte]

nah, that was just for a theoretical hitcounter
But that idea was scrapped

the list can be as long as you wish