Oh yea. But if you note, with some sniffers, one packet before there's a packet that contains some identification such as UD123456 or something like that. :/
There's a connection made by the IG.dll that get some info, when you do the login, using http connection, checking if you are already banned with this account on server.
Then idk what Gkey does. Probably it get that identification as your name suggest Getkey ¬¬ or maybe not. >.<
The connection between IG.dll and the server are encrypted, then need to check this. probably Valkyrie.ph/IG/idk. Hehe then there's only one way.
If you try to run the debugger, or any hack, it'll report to the system via http. o.o the program name and the error code.
There's 4 packets until the login packet. All encrypted. I think it's a handshake.