I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv(and objectstublessclient?)

push    offset ppv      ; Address of pointer variable that receives the interface pointer requested in riid
push    offset IShellWindows 
push    7              
push    0               
push    offset rclsid   
call    ds:_CoCreateInstance

mov     ebx, eax
mov     eax, num4
movsx   edx, num8
add     eax, edx
sub     eax, 0Ch
cmp     ebx, eax        ; S_OK, operation successful
jnz     exit

lea     eax, [ebp+var_C]    ;?
push    eax
mov     eax, ppv
push    eax
mov     edi, [eax]
call    dword ptr [edi+1Ch] ; ObjectStublessClient7

I guessed that the last called function is objectStublessClient7 given that there are three methods(queryinterface etc) and then objectStublessClient's (and code looks like it). (Is that right?)

Here it says:

ObjectStubless simply calls into ObjectStublessClient, passing the method index (from ecx) as a parameter. Finally, ObjectStublessClient teases out the format strings from the vtable and jumps to NdrClientCall2. Like NdrStubCall2, this RPCRT4.DLL routine performs the interpretive marshaling and unmarshaling just as if a compiled proxy and stub were in use.

What does ObjectStublessClient actually do in simple words? Calls a method by its index? If so, then in my case it will be OnActivate of IShellWindows? It looks like the arguments don't match (does the first one look like this?)

I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv  (and objectstublessclient?)

push    offset ppv      ; Address of pointer variable that receives the interface pointer requested in riid
push    offset IShellWindows 
push    7              
push    0               
push    offset rclsid   
call    ds:_CoCreateInstance

mov     ebx, eax
mov     eax, num4
movsx   edx, num8
add     eax, edx
sub     eax, 0Ch
cmp     ebx, eax        ; S_OK, operation successful
jnz     exit

lea     eax, [ebp+var_C]    ;?
push    eax
mov     eax, ppv
push    eax
mov     edi, [eax]
call    dword ptr [edi+1Ch] ; ObjectStublessClient7

I guessed that the last called function is objectStublessClient7 given that there are three methods(queryinterface etc) and then objectStublessClient's (and code looks like it). (Is that right?)

According to this Microsoft article:

ObjectStubless simply calls into ObjectStublessClient, passing the method index (from ecx) as a parameter. Finally, ObjectStublessClient teases out the format strings from the vtable and jumps to NdrClientCall2. Like NdrStubCall2, this RPCRT4.DLL routine performs the interpretive marshaling and unmarshaling just as if a compiled proxy and stub were in use.

What does ObjectStublessClient actually do in simple words? Calls a method by its index? If so, then in my case it will be OnActivate of IShellWindows interface? It looks like the arguments don't match (does the first one look like this?)