If you want to dive deeper into a specific part of the process, let me know:
If the developer applied VirBox's Virtual Machine protection to specific core functions, finding the OEP and fixing the IAT will still leave those specific routines unreadable. They will appear as loops of customized bytecode executing within the VirBox engine. virbox protector unpack