Question: what is ntdll used for?
Answer: NTDLL. NTDLL is the user-mode face of the Windows kernel to support any number of application-level subsystems. In the Win32 subsystem, which accounts for far and away the greatest number of Windows executables in ordinary use, the lowest layer is provided by such modules as KERNEL32.