I think it should be possible to crack it by running the program with a debugger/tracer in the background that will trace API calls. Somehow the database must be decrypted during runtime and thus the key will probably show up when the database is decrypted/loaded.