That has nothing to do with uxtheme per se. It's
just a special service
which sets user32 hooks, which use _ordinary uxtheme functions_.
Actually, no.
microsoft uxtheme imports RegisterUserApiHook and UnregisterUserApiHook.
The evidence I have suggests that uxtheme uses these to hook certain
USER32.DLL API calls (and probobly windows message processing somewhere too).