In Graph API V1.0

A call to /friends on a User object (e.g. /me/friends) or a query of the friend FQL table should return all friends of that user except

1. Those who have deactivated their accounts
2. Those who have blocked your app
3. Those who have disabled all Platform apps from accessing their data. - If a user enables this option (see below) you can't access any information about that user via the API, including their basic info, posts they make, etc. They won't appear in the friends list of your app's user via the API.

If you find friends are missing from the response it's almost certainly for one of those reasons, and in my experience most people asking this question are asking about the third case.

---

The option to remove platform option is currently under Privacy Settings -> Ads, Apps & Websites -> 'Turn off your ability to use apps, plugins, and websites on and off Facebook

If you're not getting all friends in a single call and you're sure it's not because of one of those reasons, check if you have a limit parameter in your query - and increase it if it's less than the number of friends you think should be appearing.

e.g. /me/friends?limit=5000 for the maximum number of friends allowed, 5000

Note that the friends count will include users which can't be retrieved in the list (e.g. the friend_count field of the User FQL table)

In Graph API V2.0 or higher

A call to /friends on a User object will, if the user has granted your app the user_friends permission, return the friends of that user who have also granted your app the user_friends permission -

You can read more about the change from v1.0 to v2.0 in Facebook Graph Api v2.0+ - /me/friends returns empty, or only friends who also use my app or on Facebook's changelog