This code basically translates characters based on position in one string to the character at the same position in another string and it runs for all rows in the table.
The XML you get is correct. It is XML, not text, and readable as XML by an XML parser. Special characters are properly escaped, as they should be. Whatever client module you have that consumes that XML should parse it as XML, not as text, and then it will display properly.
Update:
In case is not clear, all you need to do in your query is to treat XML as XML and text as text, not mix XML as text, ie:
;WITH CodeValues AS
(
SELECT
Number,SUBSTRING(@R,Number,1) AS R,ASCII(SUBSTRING(@U,Number,1)) AS UA
FROM Numbers
WHERE Number<=LEN(@R)
)
, XmlValues AS (
SELECT
t.RowID
,(SELECT
''+c.R
FROM Numbers n
INNER JOIN CodeValues c ON ASCII(SUBSTRING(t.Unreadable,n.Number,1))=c.UA
WHERE n.Number<=LEN(t.Unreadable)
FOR XML PATH(''), TYPE
) AS readable
FROM @TestTable t)
SELECT x.RowId,
x.readable.value('.', 'VARCHAR(8000)') as readable
FROM XmlValues AS x