I managed to run sample app on linux box.

Observations:

- I am not sure this is 'full' javascript engine. I am thinking more inline with static-eval [0]

Example 1: Date.now() returns 'Exception: undefined'

Example 2: console.log([1, 2, 3].map(function(x) { return x; })) returns 'Exception: function(x) { return x; }'

- I couldn't manage to access DOM document.write("<h1 id='x'>html</h1><script>console.log(document.getElementById('x'));</script>");

returns empty

- After reversing DLL little bit, seems like it is used as unpacker ( also it has VBA support )

Still can be some vulnerabilities, but saying running full Javascript/DOM implementation is 100% wrong

[0] https://github.com/browserify/static-eval