diff --git a/reactos/dll/ntdll/CMakeLists.txt b/reactos/dll/ntdll/CMakeLists.txt
index d99009315ac..e2b14600ddd 100644
--- a/reactos/dll/ntdll/CMakeLists.txt
+++ b/reactos/dll/ntdll/CMakeLists.txt
@@ -22,6 +22,7 @@ list(APPEND SOURCE
     ldr/ldrutils.c
     rtl/libsupp.c
     rtl/version.c
+    etw/trace.c
     include/ntdll.h)
 
 if(ARCH STREQUAL "i386")
diff --git a/reactos/dll/ntdll/def/ntdll.spec b/reactos/dll/ntdll/def/ntdll.spec
index 06be9877f52..16863d972ff 100644
--- a/reactos/dll/ntdll/def/ntdll.spec
+++ b/reactos/dll/ntdll/def/ntdll.spec
@@ -43,37 +43,37 @@
 @ stdcall DbgUiStopDebugging(ptr)
 @ stdcall DbgUiWaitStateChange(ptr ptr)
 @ stdcall DbgUserBreakPoint()
-# EtwControlTraceA
-# EtwControlTraceW
-# EtwCreateTraceInstanceId
-# EtwEnableTrace
-# EtwEnumerateTraceGuids
-# EtwFlushTraceA
-# EtwFlushTraceW
-# EtwGetTraceEnableFlags
-# EtwGetTraceEnableLevel
-# EtwGetTraceLoggerHandle
-# EtwNotificationRegistrationA
-# EtwNotificationRegistrationW
-# EtwQueryAllTracesA
-# EtwQueryAllTracesW
-# EtwQueryTraceA
-# EtwQueryTraceW
-# EtwReceiveNotificationsA
-# EtwReceiveNotificationsW
-# EtwRegisterTraceGuidsA
-# EtwRegisterTraceGuidsW
-# EtwStartTraceA
-# EtwStartTraceW
-# EtwStopTraceA
-# EtwStopTraceW
-# EtwTraceEvent
-# EtwTraceEventInstance
-# EtwTraceMessage
-# EtwTraceMessageVa
-# EtwUnregisterTraceGuids
-# EtwUpdateTraceA
-# EtwUpdateTraceW
+@ stdcall EtwControlTraceA(double str ptr long)
+@ stdcall EtwControlTraceW(double wstr ptr long)
+@ stdcall -stub EtwCreateTraceInstanceId(ptr ptr)
+@ stdcall EtwEnableTrace(long long long ptr double)
+@ stdcall -stub EtwEnumerateTraceGuids(ptr long ptr)
+@ stdcall -stub EtwFlushTraceA(double str ptr)
+@ stdcall -stub EtwFlushTraceW(double wstr ptr)
+@ stdcall EtwGetTraceEnableFlags(double)
+@ stdcall EtwGetTraceEnableLevel(double)
+@ stdcall EtwGetTraceLoggerHandle(ptr)
+@ stdcall -stub EtwNotificationRegistrationA(ptr long ptr long long)
+@ stdcall -stub EtwNotificationRegistrationW(ptr long ptr long long)
+@ stdcall EtwQueryAllTracesA(ptr long ptr)
+@ stdcall EtwQueryAllTracesW(ptr long ptr)
+@ stdcall -stub EtwQueryTraceA(double str ptr)
+@ stdcall -stub EtwQueryTraceW(double wstr ptr)
+@ stdcall -stub EtwReceiveNotificationsA() # FIXME prototype
+@ stdcall -stub EtwReceiveNotificationsW() # FIXME prototype
+@ stdcall EtwRegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr)
+@ stdcall EtwRegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr)
+@ stdcall EtwStartTraceA(ptr str ptr)
+@ stdcall EtwStartTraceW(ptr wstr ptr)
+@ stdcall -stub EtwStopTraceA(double str ptr)
+@ stdcall -stub EtwStopTraceW(double wstr ptr)
+@ stdcall EtwTraceEvent(double ptr)
+@ stdcall -stub EtwTraceEventInstance(double ptr ptr ptr)
+@ varargs EtwTraceMessage(ptr long ptr long)
+@ stdcall -stub EtwTraceMessageVa(double long ptr long ptr)
+@ stdcall EtwUnregisterTraceGuids(double)
+@ stdcall -stub EtwUpdateTraceA(double str ptr)
+@ stdcall -stub EtwUpdateTraceW(double wstr ptr)
 # EtwpGetTraceBuffer
 # EtwpSetHWConfigFunction
 @ stdcall -arch=i386 KiFastSystemCall()
diff --git a/reactos/dll/win32/advapi32/misc/trace.c b/reactos/dll/ntdll/etw/trace.c
similarity index 55%
rename from reactos/dll/win32/advapi32/misc/trace.c
rename to reactos/dll/ntdll/etw/trace.c
index 08f34020c0e..66f205740d9 100644
--- a/reactos/dll/win32/advapi32/misc/trace.c
+++ b/reactos/dll/ntdll/etw/trace.c
@@ -1,18 +1,22 @@
 /*
- * Advapi32.dll Event Tracing Functions
+ * ntdll.dll Event Tracing Functions
  */
 
-#include <advapi32.h>
+#include <ntdll.h>
 
 #include <wmistr.h>
 #include <evntrace.h>
 
-WINE_DEFAULT_DEBUG_CHANNEL(advapi);
+#define NDEBUG
+#include <debug.h>
+
+#define FIXME DPRINT1
+
 /*
  * @unimplemented
  */
 ULONG CDECL
-TraceMessage(
+EtwTraceMessage(
     TRACEHANDLE  SessionHandle,
     ULONG        MessageFlags,
     LPCGUID      MessageGuid,
@@ -24,24 +28,24 @@ TraceMessage(
 }
 
 TRACEHANDLE
-WMIAPI
-GetTraceLoggerHandle(
+NTAPI
+EtwGetTraceLoggerHandle(
     PVOID Buffer
 )
 {
-    FIXME("GetTraceLoggerHandle stub()\n");
+    FIXME("EtwGetTraceLoggerHandle stub()\n");
     return (TRACEHANDLE)-1;
 }
 
 
 ULONG
-WMIAPI
-TraceEvent(
+NTAPI
+EtwTraceEvent(
     TRACEHANDLE SessionHandle,
     PEVENT_TRACE_HEADER EventTrace
 )
 {
-    FIXME("TraceEvent stub()\n");
+    FIXME("EtwTraceEvent stub()\n");
 
     if (!SessionHandle || !EventTrace)
     {
@@ -59,38 +63,38 @@ TraceEvent(
 }
 
 ULONG
-WMIAPI
-GetTraceEnableFlags(
+NTAPI
+EtwGetTraceEnableFlags(
     TRACEHANDLE TraceHandle
 )
 {
-    FIXME("GetTraceEnableFlags stub()\n");
+    FIXME("EtwGetTraceEnableFlags stub()\n");
     return 0xFF;
 }
 
 UCHAR
-WMIAPI
-GetTraceEnableLevel(
+NTAPI
+EtwGetTraceEnableLevel(
     TRACEHANDLE TraceHandle
 )
 {
-    FIXME("GetTraceEnableLevel stub()\n");
+    FIXME("EtwGetTraceEnableLevel stub()\n");
     return 0xFF;
 }
 
 ULONG
-WMIAPI
-UnregisterTraceGuids(
+NTAPI
+EtwUnregisterTraceGuids(
     TRACEHANDLE RegistrationHandle
 )
 {
-    FIXME("UnregisterTraceGuids stub()\n");
+    FIXME("EtwUnregisterTraceGuids stub()\n");
     return ERROR_SUCCESS;
 }
 
 ULONG
-WMIAPI
-RegisterTraceGuidsA(
+NTAPI
+EtwRegisterTraceGuidsA(
     WMIDPREQUEST RequestAddress,
     PVOID RequestContext,
     LPCGUID ControlGuid,
@@ -101,13 +105,13 @@ RegisterTraceGuidsA(
     PTRACEHANDLE RegistrationHandle
 )
 {
-    FIXME("RegisterTraceGuidsA stub()\n");
+    FIXME("EtwRegisterTraceGuidsA stub()\n");
     return ERROR_SUCCESS;
 }
 
 ULONG
-WMIAPI
-RegisterTraceGuidsW(
+NTAPI
+EtwRegisterTraceGuidsW(
     WMIDPREQUEST RequestAddress,
     PVOID RequestContext,
     LPCGUID ControlGuid,
@@ -118,66 +122,66 @@ RegisterTraceGuidsW(
     PTRACEHANDLE RegistrationHandle
 )
 {
-    FIXME("RegisterTraceGuidsW stub()\n");
+    FIXME("EtwRegisterTraceGuidsW stub()\n");
     return ERROR_SUCCESS;
 }
 
-ULONG WINAPI StartTraceW( PTRACEHANDLE pSessionHandle, LPCWSTR SessionName, PEVENT_TRACE_PROPERTIES Properties )
+ULONG WINAPI EtwStartTraceW( PTRACEHANDLE pSessionHandle, LPCWSTR SessionName, PEVENT_TRACE_PROPERTIES Properties )
 {
-    FIXME("(%p, %s, %p) stub\n", pSessionHandle, debugstr_w(SessionName), Properties);
+    FIXME("(%p, %s, %p) stub\n", pSessionHandle, SessionName, Properties);
     if (pSessionHandle) *pSessionHandle = 0xcafe4242;
     return ERROR_SUCCESS;
 }
 
-ULONG WINAPI StartTraceA( PTRACEHANDLE pSessionHandle, LPCSTR SessionName, PEVENT_TRACE_PROPERTIES Properties )
+ULONG WINAPI EtwStartTraceA( PTRACEHANDLE pSessionHandle, LPCSTR SessionName, PEVENT_TRACE_PROPERTIES Properties )
 {
-    FIXME("(%p, %s, %p) stub\n", pSessionHandle, debugstr_a(SessionName), Properties);
+    FIXME("(%p, %s, %p) stub\n", pSessionHandle, SessionName, Properties);
     if (pSessionHandle) *pSessionHandle = 0xcafe4242;
     return ERROR_SUCCESS;
 }
 
 /******************************************************************************
- * ControlTraceW [ADVAPI32.@]
+ * EtwControlTraceW [NTDLL.@]
  *
  * Control a givel event trace session
  *
  */
-ULONG WINAPI ControlTraceW( TRACEHANDLE hSession, LPCWSTR SessionName, PEVENT_TRACE_PROPERTIES Properties, ULONG control )
+ULONG WINAPI EtwControlTraceW( TRACEHANDLE hSession, LPCWSTR SessionName, PEVENT_TRACE_PROPERTIES Properties, ULONG control )
 {
-    FIXME("(%s, %s, %p, %d) stub\n", wine_dbgstr_longlong(hSession), debugstr_w(SessionName), Properties, control);
+    FIXME("(%I64x, %s, %p, %d) stub\n", hSession, SessionName, Properties, control);
     return ERROR_SUCCESS;
 }
 
 /******************************************************************************
- * ControlTraceA [ADVAPI32.@]
+ * EtwControlTraceA [NTDLL.@]
  *
  * See ControlTraceW.
  *
  */
-ULONG WINAPI ControlTraceA( TRACEHANDLE hSession, LPCSTR SessionName, PEVENT_TRACE_PROPERTIES Properties, ULONG control )
+ULONG WINAPI EtwControlTraceA( TRACEHANDLE hSession, LPCSTR SessionName, PEVENT_TRACE_PROPERTIES Properties, ULONG control )
 {
-    FIXME("(%s, %s, %p, %d) stub\n", wine_dbgstr_longlong(hSession), debugstr_a(SessionName), Properties, control);
+    FIXME("(%I64x, %s, %p, %d) stub\n", hSession, SessionName, Properties, control);
     return ERROR_SUCCESS;
 }
 
 /******************************************************************************
- * EnableTrace [ADVAPI32.@]
+ * EtwEnableTrace [NTDLL.@]
  */
-ULONG WINAPI EnableTrace( ULONG enable, ULONG flag, ULONG level, LPCGUID guid, TRACEHANDLE hSession )
+ULONG WINAPI EtwEnableTrace( ULONG enable, ULONG flag, ULONG level, LPCGUID guid, TRACEHANDLE hSession )
 {
-    FIXME("(%d, 0x%x, %d, %s, %s): stub\n", enable, flag, level,
-            debugstr_guid(guid), wine_dbgstr_longlong(hSession));
+    FIXME("(%d, 0x%x, %d, %p, %I64x): stub\n", enable, flag, level,
+            guid, hSession);
 
     return ERROR_SUCCESS;
 }
 
 /******************************************************************************
- * QueryAllTracesW [ADVAPI32.@]
+ * EtwQueryAllTracesW [NTDLL.@]
  *
  * Query information for started event trace sessions
  *
  */
-ULONG WINAPI QueryAllTracesW( PEVENT_TRACE_PROPERTIES * parray, ULONG arraycount, PULONG psessioncount )
+ULONG WINAPI EtwQueryAllTracesW( PEVENT_TRACE_PROPERTIES * parray, ULONG arraycount, PULONG psessioncount )
 {
     FIXME("(%p, %d, %p) stub\n", parray, arraycount, psessioncount);
 
@@ -186,11 +190,11 @@ ULONG WINAPI QueryAllTracesW( PEVENT_TRACE_PROPERTIES * parray, ULONG arraycount
 }
 
 /******************************************************************************
- * QueryAllTracesA [ADVAPI32.@]
+ * QueryAllTracesA [NTDLL.@]
  *
- * See QueryAllTracesW.
+ * See EtwQueryAllTracesA.
  */
-ULONG WINAPI QueryAllTracesA( PEVENT_TRACE_PROPERTIES * parray, ULONG arraycount, PULONG psessioncount )
+ULONG WINAPI EtwQueryAllTracesA( PEVENT_TRACE_PROPERTIES * parray, ULONG arraycount, PULONG psessioncount )
 {
     FIXME("(%p, %d, %p) stub\n", parray, arraycount, psessioncount);
 
diff --git a/reactos/dll/win32/advapi32/CMakeLists.txt b/reactos/dll/win32/advapi32/CMakeLists.txt
index 45f3fea67e8..245749882c9 100644
--- a/reactos/dll/win32/advapi32/CMakeLists.txt
+++ b/reactos/dll/win32/advapi32/CMakeLists.txt
@@ -28,7 +28,6 @@ list(APPEND SOURCE
     misc/msi.c
     misc/shutdown.c
     misc/sysfunc.c
-    misc/trace.c
     reg/reg.c
     sec/ac.c
     sec/audit.c
diff --git a/reactos/dll/win32/advapi32/advapi32.spec b/reactos/dll/win32/advapi32/advapi32.spec
index 36f658c3b94..9e62df6b6fb 100644
--- a/reactos/dll/win32/advapi32/advapi32.spec
+++ b/reactos/dll/win32/advapi32/advapi32.spec
@@ -66,8 +66,8 @@
 @ stdcall CommandLineFromMsiDescriptor(wstr ptr ptr)
 @ stub ComputeAccessTokenFromCodeAuthzLevel
 @ stdcall ControlService(long long ptr)
-@ stdcall ControlTraceA(double str ptr long)
-@ stdcall ControlTraceW(double wstr ptr long)
+@ stdcall ControlTraceA(double str ptr long) ntdll.EtwControlTraceA
+@ stdcall ControlTraceW(double wstr ptr long) ntdll.EtwControlTraceW
 @ stub ConvertAccessToSecurityDescriptorA
 @ stub ConvertAccessToSecurityDescriptorW
 @ stub ConvertSDToStringSDRootDomainA
@@ -101,7 +101,7 @@
 @ stdcall CreateRestrictedToken(long long long ptr long ptr long ptr ptr)
 @ stdcall CreateServiceA(long str str long long long long str str ptr str str str)
 @ stdcall CreateServiceW(long wstr wstr long long long long wstr wstr ptr wstr wstr wstr)
-@ stub CreateTraceInstanceId
+@ stdcall CreateTraceInstanceId(ptr ptr) ntdll.EtwCreateTraceInstanceId
 @ stdcall CreateWellKnownSid(long ptr ptr ptr)
 @ stdcall CredDeleteA(str long long)
 @ stdcall CredDeleteW(wstr long long)
@@ -199,9 +199,9 @@
 @ stub ElfRegisterEventSourceA
 @ stub ElfRegisterEventSourceW
 @ stub ElfReportEventA
-# ElfReportEventAndSourceW
+@ stub ElfReportEventAndSourceW
 @ stub ElfReportEventW
-@ stdcall EnableTrace(long long long ptr double)
+@ stdcall EnableTrace(long long long ptr double) ntdll.EtwEnableTrace
 @ stdcall EncryptFileA(str)
 @ stdcall EncryptFileW(wstr)
 @ stub EncryptedFileKeyInfo
@@ -213,15 +213,15 @@
 @ stdcall EnumServicesStatusExA(long long long long ptr long ptr ptr ptr str)
 @ stdcall EnumServicesStatusExW(long long long long ptr long ptr ptr ptr wstr)
 @ stdcall EnumServicesStatusW(long long long ptr long ptr ptr ptr)
-@ stub EnumerateTraceGuids
+@ stdcall EnumerateTraceGuids(ptr long ptr) ntdll.EtwEnumerateTraceGuids
 @ stdcall EqualDomainSid(ptr ptr ptr)
 @ stdcall EqualPrefixSid(ptr ptr)
 @ stdcall EqualSid(ptr ptr)
 @ stdcall FileEncryptionStatusA(str ptr)
 @ stdcall FileEncryptionStatusW(wstr ptr)
 @ stdcall FindFirstFreeAce(ptr ptr)
-@ stub FlushTraceA
-@ stub FlushTraceW
+@ stdcall FlushTraceA(double str ptr) ntdll.EtwFlushTraceA
+@ stdcall FlushTraceW(double wstr ptr) ntdll.EtwFlushTraceW
 @ stub FreeEncryptedFileKeyInfo
 @ stdcall FreeEncryptionCertificateHashList(ptr)
 @ stdcall FreeInheritedFromArray(ptr long ptr)
@@ -282,9 +282,9 @@
 @ stdcall GetSidSubAuthority(ptr long)
 @ stdcall GetSidSubAuthorityCount(ptr)
 @ stdcall GetTokenInformation(long long ptr long ptr)
-@ stdcall GetTraceEnableFlags(double)
-@ stdcall GetTraceEnableLevel(double)
-@ stdcall GetTraceLoggerHandle(ptr)
+@ stdcall GetTraceEnableFlags(double) ntdll.EtwGetTraceEnableFlags
+@ stdcall GetTraceEnableLevel(double) ntdll.EtwGetTraceEnableLevel
+@ stdcall GetTraceLoggerHandle(ptr) ntdll.EtwGetTraceLoggerHandle
 @ stdcall GetTrusteeFormA(ptr)
 @ stdcall GetTrusteeFormW(ptr)
 @ stdcall GetTrusteeNameA(ptr)
@@ -294,7 +294,7 @@
 @ stdcall GetUserNameA(ptr ptr)
 @ stdcall GetUserNameW(ptr ptr)
 @ stdcall GetWindowsAccountDomainSid(ptr ptr ptr)
-# I_QueryTagInformation
+@ stub I_QueryTagInformation
 @ stub I_ScIsSecurityProcess
 @ stub I_ScPnPGetServiceName
 @ stub I_ScSendTSMessage
@@ -439,8 +439,8 @@
 @ stdcall PrivilegedServiceAuditAlarmW(wstr wstr long ptr long)
 @ stub ProcessIdleTasks
 @ stub ProcessTrace
-@ stdcall QueryAllTracesA(ptr long ptr)
-@ stdcall QueryAllTracesW(ptr long ptr)
+@ stdcall QueryAllTracesA(ptr long ptr) ntdll.EtwQueryAllTracesA
+@ stdcall QueryAllTracesW(ptr long ptr) ntdll.EtwQueryAllTracesW
 @ stdcall QueryRecoveryAgentsOnEncryptedFile(wstr ptr)
 @ stdcall QueryServiceConfig2A(long long ptr long ptr)
 @ stdcall QueryServiceConfig2W(long long ptr long ptr)
@@ -451,16 +451,16 @@
 @ stdcall QueryServiceObjectSecurity(long long ptr long ptr)
 @ stdcall QueryServiceStatus(long ptr)
 @ stdcall QueryServiceStatusEx(long long ptr long ptr)
-@ stub QueryTraceA
-@ stub QueryTraceW
+@ stdcall QueryTraceA(double str ptr) ntdll.EtwQueryTraceA
+@ stdcall QueryTraceW(double str ptr) ntdll.EtwQueryTraceA
 @ stdcall QueryUsersOnEncryptedFile(wstr ptr)
 @ stub ReadEncryptedFileRaw
 @ stdcall ReadEventLogA(long long long ptr long ptr ptr)
 @ stdcall ReadEventLogW(long long long ptr long ptr ptr)
 @ stdcall RegCloseKey(long)
 @ stdcall RegConnectRegistryA(str long ptr)
-# RegConnectRegistryExA
-# RegConnectRegistryExW
+@ stub RegConnectRegistryExA
+@ stub RegConnectRegistryExW
 @ stdcall RegConnectRegistryW(wstr long ptr)
 @ stdcall RegCreateKeyA(long str ptr)
 @ stdcall RegCreateKeyExA(long str long ptr long long ptr ptr ptr)
@@ -526,8 +526,8 @@
 @ stdcall RegisterServiceCtrlHandlerExA(str ptr ptr)
 @ stdcall RegisterServiceCtrlHandlerExW(wstr ptr ptr)
 @ stdcall RegisterServiceCtrlHandlerW(wstr ptr)
-@ stdcall RegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr)
-@ stdcall RegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr)
+@ stdcall RegisterTraceGuidsA(ptr ptr ptr long ptr str str ptr) ntdll.EtwRegisterTraceGuidsA
+@ stdcall RegisterTraceGuidsW(ptr ptr ptr long ptr wstr wstr ptr) ntdll.EtwRegisterTraceGuidsW
 @ stub RemoveTraceCallback
 @ stdcall RemoveUsersFromEncryptedFile(wstr ptr)
 @ stdcall ReportEventA(long long long long ptr long long str ptr)
@@ -587,10 +587,10 @@
 @ stdcall StartServiceCtrlDispatcherA(ptr)
 @ stdcall StartServiceCtrlDispatcherW(ptr)
 @ stdcall StartServiceW(long long ptr)
-@ stdcall StartTraceA(ptr str ptr)
-@ stdcall StartTraceW(ptr wstr ptr)
-@ stub StopTraceA
-@ stub StopTraceW
+@ stdcall StartTraceA(ptr str ptr) ntdll.EtwStartTraceA
+@ stdcall StartTraceW(ptr wstr ptr) ntdll.EtwStartTraceW
+@ stdcall StopTraceA(double str ptr) ntdll.EtwStopTraceA
+@ stdcall StopTraceW(double wstr ptr) ntdll.EtwStopTraceA
 @ stdcall SystemFunction001(ptr ptr ptr)
 @ stdcall SystemFunction002(ptr ptr ptr)
 @ stdcall SystemFunction003(ptr ptr)
@@ -629,10 +629,10 @@
 @ stdcall SystemFunction036(ptr long) # RtlGenRandom
 @ stdcall SystemFunction040(ptr long long) # RtlEncryptMemory
 @ stdcall SystemFunction041(ptr long long) # RtlDecryptMemory
-@ stdcall TraceEvent(double ptr)
-@ stub TraceEventInstance
-@ varargs TraceMessage(ptr long ptr long)
-@ stub TraceMessageVa
+@ stdcall TraceEvent(double ptr) ntdll.EtwTraceEvent
+@ stdcall TraceEventInstance(double ptr ptr ptr) ntdll.EtwTraceEventInstance
+@ varargs TraceMessage(ptr long ptr long) ntdll.EtwTraceMessage
+@ stdcall TraceMessageVa(double long ptr long ptr) ntdll.EtwTraceMessageVa
 @ stdcall TreeResetNamedSecurityInfoA(str ptr ptr ptr ptr ptr ptr long ptr ptr ptr)
 @ stdcall TreeResetNamedSecurityInfoW(wstr long long ptr ptr ptr ptr long ptr long ptr)
 @ stub TrusteeAccessToObjectA
@@ -640,9 +640,9 @@
 @ stub UninstallApplication
 @ stdcall UnlockServiceDatabase(ptr)
 @ stub UnregisterIdleTask
-@ stdcall UnregisterTraceGuids(double)
-@ stub UpdateTraceA
-@ stub UpdateTraceW
+@ stdcall UnregisterTraceGuids(double) ntdll.EtwUnregisterTraceGuids
+@ stdcall UpdateTraceA(double str ptr) ntdll.EtwUpdateTraceA
+@ stdcall UpdateTraceW(double wstr ptr) ntdll.EtwUpdateTraceW
 @ stub WdmWmiServiceMain
 @ stub WmiCloseBlock
 @ stub WmiCloseTraceWithCursor
@@ -660,8 +660,8 @@
 @ stub WmiGetTraceHeader
 @ stub WmiMofEnumerateResourcesA
 @ stub WmiMofEnumerateResourcesW
-@ stub WmiNotificationRegistrationA
-@ stub WmiNotificationRegistrationW
+@ stdcall WmiNotificationRegistrationA(ptr long ptr long long) ntdll.EtwNotificationRegistrationA
+@ stdcall WmiNotificationRegistrationW(ptr long ptr long long) ntdll.EtwNotificationRegistrationW
 @ stub WmiOpenBlock
 @ stub WmiOpenTraceWithCursor
 @ stub WmiParseTraceEvent
@@ -674,8 +674,8 @@
 @ stub WmiQuerySingleInstanceMultipleA
 @ stub WmiQuerySingleInstanceMultipleW
 @ stub WmiQuerySingleInstanceW
-@ stub WmiReceiveNotificationsA
-@ stub WmiReceiveNotificationsW
+@ stdcall WmiReceiveNotificationsA() ntdll.EtwReceiveNotificationsA # FIXME prototype
+@ stdcall WmiReceiveNotificationsW() ntdll.EtwReceiveNotificationsW # FIXME prototype
 @ stub WmiSetSingleInstanceA
 @ stub WmiSetSingleInstanceW
 @ stub WmiSetSingleItemA