¿ntdll.h? Eso no es oficial, la mejor manera de trabajar es declarando las estructuras y enumeraciones y usando enlazado dinamico en tiempo de ejecucion (en este caso GetModuleHandle + GetProcAddress). Podes usar winternl.h pero creo que no tiene todo, simplemente defini lo que no este ahi en alguna otra cabecera ...
Calling Internal APIsThe Winternl.h header file exposes prototypes of internal Windows APIs. There is no associated import library, so developers must use run-time dynamic linking to call the functions described in this header file.
The functions and structures in Winternl.h are internal to the operating system and subject to change from one release of Windows to the next, and possibly even between service packs for each release. To maintain the compatibility of your application, you should use the equivalent public functions instead. Further information is available in the header file, Winternl.h, and the documentation for each function.
If you do use these functions, you can access them through run-time dynamic linking using LoadLibrary and GetProcAddress. This gives your code an opportunity to respond gracefully if the function has been changed or removed from the operating system. Signature changes, however, may not be detectable.