Option Explicit

Dim arrKeys, arrSubKeys
Dim i, j
Dim objReg
Dim strKey, strMsg, strSubKey, strSubSubKey, strValue

Const HKCR = &H80000000

If WScript.Arguments.Count > 0 Then Syntax

strMsg = ""

Set objReg = GetObject( "winmgmts:{impersonationLevel=impersonate}!//./root/default:StdRegProv" )

objReg.EnumKey HKCR, "", arrKeys

For i = 0 To UBound( arrKeys )
	strSubKey = arrKeys(i) & "\shell"
	objReg.EnumKey HKCR, strSubKey, arrSubKeys
	If IsArray( arrSubKeys ) Then
		For j = 0 To UBound( arrSubKeys )
			strSubSubKey = arrKeys(i) & "\shell\" & arrSubKeys(j) & "\command"
			objReg.GetStringValue HKCR, strSubSubKey, "", strValue
			If InStr( 1, strValue, "RUNDLL", vbTextCompare ) Then
				strMsg = strMsg _
				       & "[HKCR\" & strSubSubKey & "]" & vbTab _
				       & Replace( strValue, "C:\WINDOWS\system32\", "", 1, -1, vbTextCompare ) & vbCrLf
			End If
		Next
	End If
	arrSubKeys = ""
Next

Set objReg = Nothing

WScript.Echo strMsg


Sub Syntax
	strMsg = vbCrLf _
	       & WScript.ScriptName & ",  Version 1.00" _
	       & vbCrLf _
	       & "List all RUNDLL(32) commands associated with file types in the registry" _
	       & vbCrLf & vbCrLf _
	       & "Usage:  CSCRIPT.EXE  //NoLogo  " & UCase( WScript.ScriptName ) _
	       & vbCrLf & vbCrLf _
	       & "Written by Rob van der Woude" _
	       & vbCrLf _
	       & "http://www.robvanderwoude.com"
	WScript.Echo strMsg
	WScript.Quit 1
End Sub