Tip: Comparing really long REG_BINARY value (Sysmon Ruleset)

I would read it like this:

(concatenations of (characters of it) whose(it != "%00") of it) of (hexadecimal strings it) of unique values of (it as string) of values "Rules" of keys "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonDrv\Parameters" of (x64 registries;x32 registries)

Here is a working example that should work on any system:

(concatenations of (characters of it) whose(it != "%00") of it) of (hexadecimal strings it) of unique values of (it as string) of values "blob" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates" of (x64 registries;x32 registries)

Here is this taken further to filter out all non-ASCII chars:

( concatenations of ( characters of it) whose( exists (hexadecimal integer (it as hexadecimal) ) whose(it >= 32 AND it <= 126) of it ) ) of (hexadecimal strings it) of unique values of (it as string) of values "blob" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates" of (x64 registries;x32 registries)

Example:

Q: ( concatenations of ( characters of it) whose( exists (hexadecimal integer (it as hexadecimal) ) whose(it >= 32 AND it <= 126) of it ) ) whose(it contains "Microsoft Windows Hardware Compatibility Intermediate CA") of (hexadecimal strings it) of unique values of (it as string) of values "blob" of keys of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates" of (x64 registries;x32 registries)
A: ?RAeD- hZ+SfNoE`X Ex+i|t3&]/`}!oZTPmQm\ 00?i0*H0p1+0)U"Copyright (c) 1997 Microsoft Corp.10UMicrosoft Corporation1!0UMicrosoft Root Authority0971001070000Z021231070000Z01+0)U"Copyright (c) 1997 Microsoft Corp.1A0?U8Microsoft Windows Hardware Compatibility Intermediate CA10UMicrosoft Corporation110/U(Microsoft Windows Hardware Compatibility00*H0N!`Z>wZ).N]DK"0;'x@+yV6rc_fI<&baL?ECjfd,u&efI=szq00U00U%250++70U0[pir#Q~Mr0p1+0)U"Copyright (c) 1997 Microsoft Corp.10UMicrosoft Corporation1!0UMicrosoft Root Authority<<>c@0*HXv`IX,dM@-M_}<TR((e^q$D$-QTDK{q:5|tm9Djy[*c"bbS`G1Wa6-SV3)'Q&Al^[PJC*o_u(6>E\#=YxQF9mR9FRTq~nJIQ`Ut,
T: 6.881 ms

Related: Parsing Registry.pol (Local Group Policy) / Get numeric ASCII values of characters in a string?