1. Windows Defender anti-virus checking the binary and contacting MS' server for binary signing/black list
2. Kernel32 trampolines
3. All sorts of security mitigation techniques such as stack cookies setup etc.
4. Telemetry
5. Hardware accelerated GUI initiation vs 'dump everything to frame buffer in kernel GUI32 library'
6. Load fonts, graphics etc. that can work well beyond 640x480
7. Deal with the scheduler juggling hundreds of processes that let you from accessing winsock2 lib immediately, to have multiplex sound mixing, to system restore, all in the background.