This should give you general idea lol 73ADCAD1 50 PUSH EAX 73ADCAD2 57 PUSH EDI 73ADCAD3 E8 7CFCFFFF CALL 73ADC754 73ADCAD8 85C0 TEST EAX,EAX 73ADCADA 78 44 JS SHORT 73ADCB20 visual style file size check ------> patch to "jmp 73ADCAFF" 73ADCADC 6A 00 PUSH 0 73ADCADE 68 30CBAD73 PUSH 73ADCB30 ; UNICODE "Microsoft Visual Style Signature" 73ADCAE3 FF76 0C PUSH DWORD PTR DS:[ESI+0C] 73ADCAE6 8D85 78FFFFFF LEA EAX,[EBP-88] 73ADCAEC 68 80000000 PUSH 80 73ADCAF1 50 PUSH EAX 73ADCAF2 FF76 08 PUSH DWORD PTR DS:[ESI+8] 73ADCAF5 FF15 B010AF73 CALL DWORD PTR DS:[73AF10B0] ; lol 73ADCAFB 85C0 TEST EAX,EAX 73ADCAFD 74 04 JE SHORT 73ADCB03 73ADCAFF 33C0 XOR EAX,EAX 73ADCB01 EB 1D JMP SHORT 73ADCB20 73ADCB03 FF15 6C41AF73 CALL DWORD PTR DS:[<&api-ms-win-core-errorhandling-l.GetLastError>]
That is the Microsoft Visual Style Signature check, its from uxtheme.dll Windows 8. But the code is very similar for windows 7 or Vista and you find in uxtheme.dll, themeui.dll,themeservice.dll and uxinit.dll for Windows 8, btw are you trying to create a patcher or something like that to load unsigned themes?