SETUPCTL
Apparently a control that was once used for the IE update
web site which is no longer in use, although it should
still exist on a lot of systems. With this exploit, similar
to the PDF exploit, ESP points to our code so we simply RET
to the same JMP ESP in Shell32. Also, this exploit differs
in that we set a property first (DistUnit) with the long
string, then call the method (InstallNow). Again, I have
simply demonstrated how to execute CALC.EXE, though any
code can be executed.