The SCM executable, Services.exe, runs as a Windows console program and is launched by the Wininit process early during the system startup.
Next, it calls the ScAutoStartServices() function which loops through all the services marked as auto-start, paying attention to the calculated load-order dependencies.
For delayed auto-start services, grouping has no effect, and those are loaded at a later stage of system startup.
Every service that does not run in the System account is logged in by calling the LSASS function LogonUserEx(), for which LSASS process looks up "secret" passwords stored in the HKLM\SECURITY\Policy\Secrets\ registry key, which were stored by the SCP using the LsaStorePrivateData() API, when the service was originally configured.
For that purpose, the NtLoadDriver system call is invoked, and the SeLoadDriverPrivilege is added to the SCM's process.