It's almost impossible as the Battery and keyboard controls are into EC Code so crypted an x86 code.
There are a few examples about this on two types Lenovo, the first Modder was Mattew Chapman (zmatt.net) and then hamish coleman :
https://zmatt.net/unlocking-my-lenovo-laptop-part-1/
https://hackaday.com/2016/02/11/unlockin...batteries/
http://ivanbayan.com/index.php/2020/03/2...same-time/
https://github.com/hamishcoleman/thinkpad-ec
That's enogh to understand that it is carried into EC
Notes :
There’s an exceptionally large community dedicated to Thinkpad firmware hacks, reverse engineering, and generally turning Thinkpads into the best machines they can be.
With the schematics for his laptop in hand, [Matt] found the embedded controller responsible for battery charging, and after taking a few educated guesses had some success.
He ran into problems, though, when he discovered some strangely encrypted code in the software image. A few Russian developers had run into the same problem,
and by wiring up a JTAG to the embedded controller chip, this dev had a fully decrypted Flash image of whatever was on this chip.
Thanks be to Russian hackers
But remember that I hypothesised that the EC firmware is stored in flash memory in decrypted form.
If we could read that flash memory via some side channel, we would presumably be able to extract the decryption function.
So all credits goes to the Big Modder Mattew Chapman !!!