Having the LLM run the proprietary app through ghidra (which I think even has an MCP now), would likely give it some useful clues too