Create custom welcome email without a plugin

This seems like a nice idea, which would also work in functions.php:

// Add filter for registration email body
add_filter('wp_mail','handle_wp_mail');

function handle_wp_mail($atts) {
    /*"Your username and password" is the subject of the Email WordPress send from "function wp_new_user_notification" in file "wp-includes/pluggable.php"*/

    if (isset ($atts ['subject']) && substr_count($atts ['subject'],'Your username and password')>0 ) {
    if (isset($atts['message'])) {
       $atts['message'] = 'new body';
    }
    }
    return ($atts);
}

Just watch out for the language to get the right subject string. (Source: http://wordpress.org/support/topic/how-to-change-registration-email-content?replies=3)

So I think the answer is no, you aren't able to do this in a safe manner.

I'm afraid you'll have to use the pluggable functions feature - there's no filter or hook inside those functions (as you can see from the code below). And what's worse, for you, it's better to use pluggable function in a plugin.

This is because defining new pluggable function in your theme's functions.php requests you to use a definition of a new function in a function (in order to call it as soon as all plugins are fully loaded), which may be bad (see comments below this post), but on the other hand, it works - see code below the first one.

For those who are not against plugins, here's one which rewrites a pluggable function - just save it into my_plugin.php (or anything else) to you plugins directory and activate from your admin:

<?php
/*
Plugin Name: Name Of The Plugin
Plugin URI: http://URI_Of_Page_Describing_Plugin_and_Updates
Description: A brief description of the Plugin.
Version: The Plugin's Version Number, e.g.: 1.0
Author: Name Of The Plugin Author
Author URI: http://URI_Of_The_Plugin_Author
License: A "Slug" license name e.g. GPL2
*/
if( !function_exists('new_user_notification') ){
function new_user_notifiaction(){
        /**
         * Notify the blog admin of a new user, normally via email.
         *
         * @since 2.0
         *
         * @param int $user_id User ID
         * @param string $plaintext_pass Optional. The user's plaintext password
         */
        function wp_new_user_notification($user_id, $plaintext_pass = '') {
            $user = get_userdata( $user_id );

            $user_login = stripslashes($user->user_login);
            $user_email = stripslashes($user->user_email);

            // The blogname option is escaped with esc_html on the way into the database in sanitize_option
            // we want to reverse this for the plain text arena of emails.
            $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);

            $message  = sprintf(__('New user registration on your site %s:'), $blogname) . "\r\n\r\n";
            $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
            $message .= sprintf(__('E-mail: %s'), $user_email) . "\r\n";

            @wp_mail(get_option('admin_email'), sprintf(__('[%s] New User Registration'), $blogname), $message);

            if ( empty($plaintext_pass) )
                return;

            $message  = sprintf(__('Username: %s'), $user_login) . "\r\n";
            $message .= sprintf(__('Password: %s'), $plaintext_pass) . "\r\n";
            $message .= wp_login_url() . "\r\n";

            wp_mail($user_email, sprintf(__('[%s] Your username and password'), $blogname), $message);

        }
    }
}

Just if you're curious, here a the same efect managed from functions.php with a new function defined inside another function:

//redefine wp_new_user_notification as soon as all plugins are loaded
add_action( 'plugins_loaded', 'new_user_notifiaction' );

function new_user_notifiaction(){
    /**
     * Notify the blog admin of a new user, normally via email.
     *
     * @since 2.0
     *
     * @param int $user_id User ID
     * @param string $plaintext_pass Optional. The user's plaintext password
     */
    function wp_new_user_notification($user_id, $plaintext_pass = '') {
        $user = get_userdata( $user_id );

        $user_login = stripslashes($user->user_login);
        $user_email = stripslashes($user->user_email);

        // The blogname option is escaped with esc_html on the way into the database in sanitize_option
        // we want to reverse this for the plain text arena of emails.
        $blogname = wp_specialchars_decode(get_option('blogname'), ENT_QUOTES);

        $message  = sprintf(__('New user registration on your site %s:'), $blogname) . "\r\n\r\n";
        $message .= sprintf(__('Username: %s'), $user_login) . "\r\n\r\n";
        $message .= sprintf(__('E-mail: %s'), $user_email) . "\r\n";

        @wp_mail(get_option('admin_email'), sprintf(__('[%s] New User Registration'), $blogname), $message);

        if ( empty($plaintext_pass) )
            return;

        $message  = sprintf(__('Username: %s'), $user_login) . "\r\n";
        $message .= sprintf(__('Password: %s'), $plaintext_pass) . "\r\n";
        $message .= wp_login_url() . "\r\n";

        wp_mail($user_email, sprintf(__('[%s] Your username and password'), $blogname), $message);

    }
}