How does this question differ to your question here?
Your key is Renjx%2$CjM.
You can use the zcu module I have written to decode your configuration file e.g.
$ python3 examples/decode.py config.bin config.xml --key 'Renjx%2$CjM'
$ head config.xml
<Tbl name="DBBase" RowCount="1">
<DM name="IFInfo" val="...
In some games I have found the encryption on, it has been before the send call e.g. a function that calls send sometimes 2-3 calls up.
For recv it is decrypting after but some first decrypted part of it for a header to look up the size/id.
Others had compressed packets (zlib) which took a little bit of figuring.
A trick to see if is possibly compressed or ...
The encryption routine is not likely to be in your call stack because it is not actually going to call the send function directly.
I would suggest you set a watch point inside the buffer to catch whenever the buffer is written to. Routines that write to the buffer will probably be reading from some input buffer. There could well be a few steps of adding ...
You can use the zcu module to do this.
python examples/encode.py config.bin.xml out.bin --key 'GrWM2Hz<vz&f^5' --signature 'ZXHN H108N V2.5'
Full disclosure: I wrote the zcu module. It's based off of this pastebin.