I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv(and objectstublessclient?) push offset ppv ; Address of pointer variable that receives the interface pointer requested in riid push offset IShellWindows push 7 push 0 push offset rclsid call ds:_CoCreateInstance mov ebx, eax mov eax, num4 movsx edx, num8 add eax, edx sub eax, 0Ch cmp ebx, eax ; S_OK, operation successful jnz exit lea eax, [ebp+var_C] ;? push eax mov eax, ppv push eax mov edi, [eax] call dword ptr [edi+1Ch] ; ObjectStublessClient7 I guessed that the last called function is objectStublessClient7 given that there are three methods(queryinterface etc) and then objectStublessClient's (and code looks like it). *(Is that right?)* [Here](http://www.microsoft.com/msj/0199/com/com0199.aspx) it says: > ObjectStubless simply calls into ObjectStublessClient, passing the method index (from ecx) as a parameter. Finally, ObjectStublessClient teases out the format strings from the vtable and jumps to NdrClientCall2. Like NdrStubCall2, this RPCRT4.DLL routine performs the interpretive marshaling and unmarshaling just as if a compiled proxy and stub were in use. What does ObjectStublessClient actually do in simple words? Calls a method by its index? If so, then in my case it will be OnActivate of [IShellWindows](http://msdn.microsoft.com/en-us/library/windows/desktop/cc836570%28v=vs.85%29.aspx)? It looks like the arguments don't match (does the first one look like `this`?)