What you could do is change the IDL signature from this

[id(2)] HRESULT Add([in] int Value1, int Value2, [out] int *ReturnValue);

to this

[id(2)] HRESULT Add([in] int Value1, int Value2, [out, retval] int *ReturnValue);

which makes a lot of sense here because it is semantically a return value. See the retval attribute documentation for info on this.

Then you can call it like this in VBScript:

ret = Add(1, 2)

Otherwise, check this for more on byref in VBScript: ByRef and ByVal in VBScript