Flags that I have assigned during my analysis, https://r00tten.com/late-night-show-apt28-phishing-document/

43d7ffd611932cf51d7150b176ecfc29_r2DLL

f sus.copyToBuffer 0 0x100030df 
f sus.lengthAsByte 0 0x10002b99 
f sus.internetReadFile_caller 0 0x10003621 
f sus.createMutex 0 0x10002cfc 
f sus.mainRoutine 0 0x10005b94 
f sus.decrypterFunc 0 0x10002f3f 
f sus.heapFree_un 0 0x10003f83 
f sus.multiByteToWideChar_caller 0 0x1000369a 
f sus.base64Decode 0 0x10002d4b 
f sus.base64Encode 0 0x10002d8f 
f sus.createProcessW_caller 0 0x10003274 
f sus.setLastError_caller 0 0x100037ff 
f sus.expandEnvironmentStringsW_caller 0 0x10003375 
f sus.writeAlphaNum 0 0x10003dd3 
f sus.obtainUserAgentString_caller 0 0x10003719 
f sus.keyPressSimulator 0 0x10003863 
f sus.openClipboard_caller 0 0x1000378f 
f sus.getClipboardData_caller 0 0x100033dc 
f sus.closeClipboard_caller 0 0x10003207 
f sus.iStreamSize_caller 0 0x100035ae 
f sus.iStreamReset_caller 0 0x1000353e 
f sus.iStream_Read_caller 0 0x100034c8 
f sus.writeAlphaNum_caller 0 0x10003dbe 
f sus.url_pageBuilder 0 0x10004ecc 
f sus.id_xor_base64 0 0x10002f91 
f sus.processEnum 0 0x10004543 
f sus.diskEnum 0 0x100045ea 
f sus.screenShotFunc 0 0x10004686 
f sus.uriBuilder_id_xxx 0 0x10005713 
f sus.internetCloseHandle 0 0x10004889 
f sus.internetCon 0 0x100048a9 
f sus.getSizeOfContent 0 0x1000344c 
f sus.googleConTest_caller 0 0x100053d0 
f sus.googleConTest 0 0x10004d31 
f sus.getVolumeInformation 0 0x10004665 
f sus.obtainUserAgentString_caller2 0 0x100041cb 
f sus.regServersEnum 0 0x100052c3 
f sus.googleDecrypter 0 0x10005521 
f sus.internetCon_caller 0 0x10005a80 
f sus.hostNameEnum 0 0x100055a5 
f sus.volume_UserAgent_Enum 0 0x10005493 
f sus.connectionTest 0 0x100058e7 
f sus.enumFunc 0 0x100049bf 
f sus.sleep_caller 0 0x10005b7b 
f sus.updateOrCreateDomainRegKey 0 0x1000599d 
f sus.CCconn_Response 0 0x10004fc8 
f sus.clean_____caller 0 0x10005fbd 
f sus.clean 0 0x10006039 
f sus.isIP_Received 0 0x1000607e 
f sus.readFile_caller 0 0x10006501 
f sus.ifFileExistTakeTheFileName 0 0x1000605f 
f sus._ecx_assignToEax 0 0x10003bbd 
f sus._file_Actions_caller 0 0x10006377 
f sus._file_Actions 0 0x10003954 
f sus.cleanTo_file 0 0x100038e3 
f sus.shellCodeExecute 0 0x10006c19 
f sus.freeShellCode 0 0x10006ba1 
f sus.responseParser 0 0x100060d6 
f sus._ecx__0 0 0x10006b8d 
f sus.assign0ToArray 0 0x100038d0 
f sus.commandParser 0 0x100063d9 
f sus.__searcher 0 0x10003132 
f sus.readFile 0 0x10003bc0 
f sus.appdata_FirefoxEnum 0 0x10006725 
f sus.xor_base64 219 0x10002f91 
f sus.uriBuilder_id 212 0x10005713 
f sus.dataStructInit 142 0x10005493