http://valinet6l6tq6d5yohaa6gdsf2ho4qcqcxyj2nahp5kd4z7nsa6ycdqd.onion/2020/09/07/Case-study-Get-dark-command-windows-all-the-time-in-Windows-10.html
Taking into account more from the above, just run the process once under the debugger, and start our own process that calls LoadLibrary(L"uxtheme"); GetProcAddress(GetModuleHandle(L"uxtheme"), MAKEINTRESOURCEA(0x84)) . Again, compare the address from the debugged console to what we get in our process.