The F4 starts execution by reading the initial SP and PC from address 0/4 in flash. The set of interrupt vectors follows immediately after that.
The entry point and the vectors are defined in flight/PiOS/STM32F4xx/startup.c:
struct cm3_vectors cpu_vectors __attribute((section(".cpu_vectors"))) = {
.initial_stack = &irq_stack[sizeof(irq_stack)],
.entry = (vector *)_main,
.vectors = {
NMI_Handler,
HardFault_Handler,