ok, further to what I mentioned before about RegisterUserApiHooks (and poking around in uxtheme.dll), I see the following things being hooked by uxtheme (at least it seems to be the complete list) GetScrollInfo SetScrollInfo EnableScrollBar SetWindowRgn DefWindowProcW DefWindowProcA PreWndProc (probobly stuff that happens internally before the window procedure gets called) PostWndProc (probobly stuff that happens internally after the window procedure gets called) PreDefDlgProc (probobly connected to dialog boxes) PostDefDlgProc (probobly connected to dialog boxes) GetSystemMetrics SystemParametersInfoA SystemParametersInfoW DrawFrameControl DrawCaption MDIRedrawFrame (probobly related to MDI frame windows)
Best guess is that RegisterUserApiHook and UnregisterUserApiHook are specifically provided so that uxtheme can override/hook code in user32.dll but at the same time if the themes service is disabled, none of the theming code kicks in. What probobly happens is that uxtheme.dll is loaded into every process (since even apps that know nothing about theming still get themed non-client areas etc AFAIK) which then hooks the user32 APIs to draw the themeing for the non-client areas. Then, theme-aware apps provide a manifest and link to the comctl32.dll 6.0 and from there get proper theming for all their standard (and common) controls.
Ordinal 34 (not given any external name by MS) in uxtheme.dll is what installs the user API hooks (what calls it I have no idea, probobly some system component, mabie the Theme service)