Help needed with mt4 decompile (programmers look plz)

Has anyone with any RCE knowledge or assembly language / debugging training ever tried to scan/dump/unpack mt4's terminal.exe from various different providers. The obfuscation in the server.ini and some of the .ini files in the configuration folder worries me.

Basically after much trouble and several PE type databases and scanners I finally was able to find out the packer for terminal.exe, apparently VMProtect 1.6, but what worries me is that RDG claims possible Keylogger inside terminal.exe, this worries me greatly. I have tried a fresh download of the PE from a leading broker and the situation is the same so I know its not some one-off anomaly.

If anyone has successfully unpacked mt4 and deobfuscated the .ini files Id be greatly interested in your results. Trusting my hard earned dollars to an obfuscated to living hell and possibly keylogged app is not my idea of smart. It could be the start of something big.

Oh, and the anti-debug protection on terminal.exe is pretty heavy duty for a 'free' non-malicious program.

It doesn't surprise me in the least.

puh, wow, thanks a lot for the info. is there a way to find out what the program does in detail (e.g. "telephone to home", "send userdata to server xyz", etc.)?

Well yeah, you can find out everything. It's your computer, if you are so inclined to know what the application is doing on a forensic level then learn how to unpack/dump/debug (reverse engineer).

The holy grail or goal of everything would be to disassemble then decompile the application to get it as close to the original source code as possible. It's complex, especially with the array of PE (portable executable, e.g .exe/.dll files) packers and obfuscators. Whats definitely worrying me the most is RDG when scanning terminal.exe comes up as saying theres a possible Keylogger inside the PE. Not to mention RDG was the only scanner that was even able to properly ID the PE. PEid, Prot. ID, and DIE didn't even get the packer right (VMprotect 1.6) or barely any info due to its heavy packing.

This is the problem I am having, and I am astounded to see that nobody has actually tried to unpack or run mt4 in a debugger. Although it's not anything strange for an app to be packed properly and their source protected, this is seeming very shady and I am just interested what is going on with the program that controls my finances. Hopefully there is someone on this forum with experience in assembly code or reverse engineering. Until then I am going to attempt to unpack and deobfuscate mt4 and its various 'flavors' from the different brokers. The obsfucated binary text files that are supposed to be basic .ini text files in the config folder are flashing big giant red flags for me. I have never seen a encrypted bloody .ini. This could be the smoking gun here, or how the brokers are modifying their versions of mt4 without unpacking and modifying the .exe. Which would most likely be technically illegal for them to do, but not modifying the settings files then obfuscating their changes to hide them from us.

Hopefully no sneaky broker PR agents read this and get nasty.

Any help from ereet hax0rs would be welcome :-) (especially ones with assembly language / RCE / debugging xperience)

Thanks a lot ch0c.
So far i know, the keylogger normally "catch" what we type using keyboard. Do you mean, it can be a spy to our indicator/script/ea? I am new to this kind of thing, just ask google's help, and got ; IDA & Oli Dbg. But, i do not know how to use it ... .... will try to ask a friend ...