It's a bad idea to use LoadLibrary here to get a module handle to ntdll.dll. For one thing, unless the call is balanced by a call to FreeLibrary it causes the process's reference count on ntdll.dll to continually increase. Secondly, its completely unnecessary because ntdll.dll is already loaded into every Win32 process. If you need to get a module handle to ntdll.dll, just use GetModuleHandleA("ntdll.dll").