Payload URL reassembled from cmd character-index dropper

The macro hides its download command behind two reversible layers: the URL-bearing command is concatenated from string literals scattered across many helper functions (the visible code is padded with dead TypeName/arithmetic junk), then rebuilt by a cmd.exe character-index loop (set <var>=<charset> & for %p in (<indices>) do !<var>:~%p,1!) into a PowerShell downloader that tries an @-separated list of fallback hosts. The analyzer folds the VBA concatenation, decodes the character-index stage, and surfaces the recovered hosts as IOCs. Self-validating: only transforms yielding syntactically valid host URLs are reported.