At this point, the process environment has been determined, resources for its threads to use have been allocated, the process has a thread, and the Windows subsystem knows about the new process. Unless the caller specified the
CREATE_SUSPENDED flag, the initial thread is now resumed so that it can start running and perform the remainder of the process-initialization work that occurs in the context of the new process (stage 7).
The new thread begins life running the kernel-mode thread startup routine
KiStartUserThread lowers the thread’s IRQL level from deferred procedure call (DPC) level to APC level ...