Info I've gathered on NexonGuard:
Doesn't seem to have anything to do with BlackCipher, at least currently and that I saw (BlackCipher.aes isn't running, modules aren't loaded, log dates are still old).
NGGate.bin and NGCore.bin are loaded into the Client. Functions in both seem to be obfuscated at a quick glance.
NGXXXX.tmp files, where XXXX is a seemingly random hexadecimal number, get put in your %TEMP% folder. They will keep being generated too, which may take up a nice amount of drive space if left unchecked. Two will be created and loaded into the Client each time it is run but doesn't seem to get deleted when closing.
Encrypted logs, as usual.
eTracer.aes is the Nexon crash report? "Tasket: If you receive the e-tracer pop up at any point after the crash, please click the send button." Haven't checked it personally.
Most of this information is fairly easy to obtain, nothing is in depth at all, but that's what I have with the little time I looked into it.