All binfmt does is allow exec() and friends to run a custom wrapper program; for example, qemu or wine.

Windows / NT subsystems (and specifically, here, picoprocesses), effectively intercept all entries into kernelmode from a particular process; when you execute a syscall instruction, the kernel invokes subsystem-specific code.