Payload URL assembled from a Chr()/Asc() string expression

The macro assembles its stage-2 download URL character by character from string literals concatenated with Chr()/Asc()/StrReverse() results — often nested (Chr(Asc(Chr(Asc("h")))) = "h") and split across the + and & operators, sometimes emitted via Print #n, into a second-stage VBScript/PowerShell file. There is no numeric array to brute-force and the URL is never contiguous on disk, so the literal scan and the array recoverers all miss it (the "adobeacd-update" maldoc family). A bounded VBA value-expression evaluator resolves the expressions and harvests the URL. Self-validating: only a valid host URL that is not already present verbatim in the macro is reported, so a benign macro cannot false-positive.