The service control manager (SCM) calls ServiceMain when you open the Services Control Panel application, select the service, and click Start.
After the SCM calls ServiceMain, a service must give the SCM a handler function. This function lets the SCM obtain the service's status and pass specific instructions (such as pausing or stopping). The SCM gets this function when the service passes _Handler to the Win32 API function, RegisterServiceCtrlHandler. (_Handler is a static member function that calls the non-static member function Handler.)
At startup, a service should also inform the SCM of its current status. It does this by passing SERVICE_START_PENDING to the Win32 API function, SetServiceStatus.
ServiceMain then calls CAtlExeModuleT::InitializeCom, which calls the Win32 API function CoInitializeEx. By default, InitializeCom passes the COINIT_MULTITHREADED flag to the function. This flag indicates that the program is to be a free-threaded server.
Now, CAtlServiceModuleT::Run is called to perform the main work of the service. Run continues to execute until the service is stopped.