Here's the query if anyone needs it:
if object_id('dbo.fn_SQLServerBUDir') is not null
drop function dbo.fn_SQLServerBUDir
go
CREATE function dbo.fn_SQLServerBUDir()
returns nvarchar(4000)
as
begin
declare @rc int,
@dir nvarchar(4000)
exec @rc = master.dbo.xp_instance_regread N'HKEY_LOCAL_MACHINE',N'Software\Microsoft\MSSQLServer\MSSQLServer',N'SQLArg1',...