-1) The DLL which loads must be in shared memory (in upper 2GB). It can be achieved with linker flags for MS VC, but i had to patch PE header and DllMain since PB compiler sucks (i suck too since i don't like VC). It is also nice to make base DLL address also above 2GB.
0) It must not be unloaded, since new functions point to it. I achieved it by using undocumented (used by malware) MPRServices key. Also this way i achieved asynchronous loading and my dll stays in memory until mprexe.exe is killed (and it must not be killed).
1) Get loaded DLL base address with LoadLibrary or GetModuleHandle. It is a pointer to IMAGE_DOS_HEADER. Via ->e_lfanew you get IMAGE_NT_HEADERS ptr, via ->OptionalHeader you get IMAGE_OPTIONAL_HEADER ptr.
2) Get IMAGE_EXPORT_DIRECTORY. Here, we can have access to array of function entries, names and their connection.
3) So what? We can modify those arrays or make new ones and make AddressOfFunctions, AddressOfNames, AddressOfNameOrdinals point to our arrays (they must in our shared library space). Don't forget that they're all RVA and thus we have to substract base image from our function addresses.
4) But wait, we can't modify them. All upper 2GB is protected from user space. We have to use PageModifyPermissions hack to have access to them! (also used by malware)
5) Voila! Now, everytime hacked library is loaded, new EAT is used and our functions take place directly, while our DLL can use original library functions directly.
6) This method works only for shared system DLLs: kernel32,user32,gdi32,comctl32,advapi32 and other minor ones. Non-shared dlls are other story. Also, you can't directly link your shared dll to non-shared one. It'll be painful to make unicows.dll work normally, so it is better to reimplement it.

[HKEY_CURRENT_USER\Control Panel\desktop]
"TransparentIcons"=dword:00000001