r2pipe script for the shellcode, https://r00tten.com/in-depth-analysis-rtf-file-drops-agent_tesla/

c14c8d99ab4652e631b61af1dca873b4_shellcode-r2pipe.py

#!/usr/bin/python
import r2pipe

file = open('importsNtdll', 'r')
#file = open('importsKernel32', 'r')
imports = file.read()
file.close()
imports = imports.split('\n')

file = open('hashes', 'r')
hashes = file.read()
file.close()
hashes = hashes.split('\n')

r = r2pipe.open('shellcode_modified', flags=['-w'])
r.cmd('e asm.bits = 32')

index = 0

for i in imports:
    if i == '':
        break
    r.cmd('w ' + i + '\0 @ 0x5d0')
    r.cmd('dr eip = 0x0000002b')
    r.cmd('ds')
    r.cmd('dr ecx = ' + str(len(i)))
    r.cmd('dr edi = 0x5d0')
    r.cmd('dr esi = 0x0')

    eip = r.cmd('dr?eip')
    
    if int(eip, 16) != int('0x0000002b', 16):
        r.cmd('dr eip = 0x0000002b')

    while int(eip, 16) != int('0x0000004f', 16):
        r.cmd('ds')
        eip = r.cmd('dr?eip')

    reg = r.cmd('dr?esi')
    if reg != '':
        for j in hashes:
            if j == '':
                break
            if int(reg, 16) == int(j, 16):
                print j + '   ===   ' + i
                index = index + 1

    if index >= len(hashes):
        break