I'm reversing malware and it uses COM, which I evidently don't know. My question is how to find out what method is called using ppv(and objectstublessclient?)

    push    offset ppv      ; Address of pointer variable that receives the interface pointer requested in riid
    push    offset IShellWindows 
    push    7              
    push    0               
    push    offset rclsid   
    call    ds:_CoCreateInstance

    mov     ebx, eax
    mov     eax, num4
    movsx   edx, num8
    add     eax, edx
    sub     eax, 0Ch
    cmp     ebx, eax        ; S_OK, operation successful
    jnz     exit

    lea     eax, [ebp+var_C]    ;?
    push    eax
    mov     eax, ppv
    push    eax
    mov     edi, [eax]
    call    dword ptr [edi+1Ch] ; ObjectStublessClient7

I guessed that the last called function is objectStublessClient7 given that there are three methods(queryinterface etc) and then objectStublessClient's (and code looks like it). *(Is that right?)*

[Here](http://www.microsoft.com/msj/0199/com/com0199.aspx) it says:
> ObjectStubless simply calls into ObjectStublessClient, passing the method index (from ecx) as a parameter. Finally, ObjectStublessClient teases out the format strings from the vtable and jumps to NdrClientCall2. Like NdrStubCall2, this RPCRT4.DLL routine performs the interpretive marshaling and unmarshaling just as if a compiled proxy and stub were in use. 

What does ObjectStublessClient actually do in simple words? Calls a method by its index? If so, then in my case it will be OnActivate of [IShellWindows](http://msdn.microsoft.com/en-us/library/windows/desktop/cc836570%28v=vs.85%29.aspx)? It looks like the arguments don't match (does the first one look like `this`?)