Doing a dump of the imports table from native uxtheme.dll from my XPSP2 box, I see that it imports a function from user32.dll called RegisterUserApiHook which is totally undocumented (neither MSDN or google show up any info about what it does). This function is only present in Windows XP (and I assume Server 2003 which also has uxtheme). Based on the name, I suspect that it is a function that lets uxtheme hook user32 api calls (without documentation or code to that function, I cant really say anything more)