As a not-super-useful but concept-proving demonstration, this creates an IFhConfigMgr and calls AddRef:
newslot native fhPtr call ole32.dll!CoCreateInstance /return uint (blockptr(guid {ED43BB3C-09E9-498a-9DF6-2177244C6DB4}), nullptr, int 1, blockptr(guid {6A5FEA5B-BF8F-4EE5-B8C3-44D8A0D7331C}), slotptr fhPtr) newslot native fh copyslot fh = fhPtr dereferenced newslot block vtbl = nullptr, nullptr, nullptr, nullptr copyslot vtbl = fh dereferenced newslot native addref copyslot addref = vtbl field 1 call funcat addref /call thiscall /return uint (slotdata fhPtr)
The funcat (that's "function at", not "fun cat", even though cats are pretty great) keyword on the call command is the new addition that does all the heavy lifting.