I picked through the source code.

The `decode()` function is simply a Base64 decoder. Most of its arguments and local variables serve no purpose at all.

Likewise, the `ratifyvWk()` function, which decrypts a string by performing Base64 decoding (using the above function) followed by a Vigenère-style XOR decryption step with the key `VtiEH9DlpPnDjlsD`.

The only useful thing that `nexusQLE()` does is return an object that can be used to access the ActiveX `WScript.CreateObject()` function. Finally the anonymous function uses this to download and run a .exe file from either of two sites. Here's the de-obfuscated source code (converted to an image because the two download locations still seem to be active):

[![De-obfuscated JS malware][1]][1]

This will only work on Windows computers with [incorrect security settings](http://stackoverflow.com/q/9349278/1679849), but I guess this still happens.


  [1]: https://i.sstatic.net/3mTod.png