ah, WPBT acpi table
expected usecase: automatic execution of software “absolutely critical for the execution of Windows” that cannot be distributed any other way (source: WPBT spec)
actual usecase: a mix of actual malware (absolute computrace) and potentially unwanted programs (oem crapware), less “absolutely critical for the execution of Windows” and more “absolutely critical for the execution of business model”