Payload URL decoded from an encoded PowerShell loader

The macro assembles (from string literals scattered across helper functions, padded with dead TypeName/arithmetic junk) a WScript.Shell command that runs a PowerShell stage-2 loader. The download URL is stored as a numeric char-code array decoded at runtime by [char]($_ -bxor k) (or +k / -k) after splitting on obfuscated, case-folded delimiters, so no literal URL scan sees it. The analyzer folds the VBA concatenation, treats every run of small numbers as an array, brute-forces the per-element transform, and accepts only a decode that yields a valid host URL — typically an @-separated fallback list dropped to %TEMP% and executed. Self-validating, so a benign numeric table cannot false-positive.