How to reverse engineer a crypted virus written in jscript (WSH)?

Question

Malware

I attached the virus code ( download code ) to the post in a pdf file so that the person who downloaded it would not accidentally launch it. The virus is dangerous, and can do great harm. For those who are especially curious: the virus encrypts all files, and an email address appears on the desktop for communication with (you yourself know with whom and for what).
As I understand it, the script does not store malicious commands in itself. There are functions that return individual characters that make up strings. They are then executed by the eval() function. This is done so that the antivirus does not work. Example:

function IM()
{
var XBt=38774;
return "S";
}

function W(svu)
{
  var OF=30586;
  var wg=OF+24239;
  var kdy=wg/255;
  var mi=kdy-214;
  var bHh = eval(Nx() + (svu+mi) + uSk());

  return bHh;
}

I want to refactor this code to a normal form in order to understand what it does, how it works, and what algorithm is used for encryption. I had 2 options:
1) manually rewrite, instead of functions, immediately write the characters that they return, remove the excess (yes, there are variables that are stupidly declared and not used)
2) debugging in googlechrome (and what, the syntax is the same , Chrome will crash on eval(), I will look in the logs for which Windows function is called there, transfer it to a separate file, and remove it from the code. Then all over again.
At the same time, I always have the opportunity to check the result on virtualbox.
And so, The very question is: how can this code be brought to a readable, understandable form?The first option is long (there are 1500 lines in the code), the second option is doubtful.
(note just in case: I have ubuntu on board, on a Windows XP virtual machine, )

Answer 1

In reverse engineering, out of ten paths, you should choose all ten. :)
Combine, and also try the third way, still look for an unpacker that can.
Better in the "native" environment - Internet Explorer, MSHTA, in general MSHTML (Trident), I don't know if there is a debugger specifically for separate JScript scripts, but somewhere in IE there should be, if you study the topic normally, then there will be no doubt.
You won't see "window functions" if you don't redefine them with "hooks" yourself, somehow you primitively imagine debugging, you need to fully understand - not just logging, but set breakpoints, and line by line, look at the values ​​of variables to get to the decoded one, but here what is always worth overriding is eval, again look at the value it takes.
In parallel with debugging, it is necessary to write documentation in Notepad, I write simply in text - which function does what, which one it calls.