For fun I downloaded an installer from a "driver downloads" website.  I do NOT intend on installing it, but I was interested to check it out just to see what it looked like.  I tossed it into ollydbg (without advancing the pointer) and just browsed the assembly.  

There are multiple different calls/jumps/far jumps to various "ntdll.addr" 

I know ntdll is a pretty low-level library, but I just don't have enough experience in windows x86 disassembly to know what's "normal."  This is also ostensibly, a driver installer, so it seems reasonable that there would be calls into ntdll.  Are jumps like that considered normal behavior?  Usually I'm used to seeing calls that expressly name the function... not a specific address in ntdll.  

--Extra detail/context--
The file wasn't packed, but there were a few spots where the full printable ASCII `[A-Za-z]` appeared in the hex view, which I recall could be a sign that there's base64 encoding/decoding going on somewhere. Maybe shift-ciphers.  

For reference, the precise binary I'm peering into is [here][1].  Windows 7 64b.  (The installer itself appears to be 32b... olly loaded it fine, and IDA free too.)

PEBrowse64 also showed me something possibly suspicious under Resources->STRING->4085

in this section there appears to be strings set aside for pageup/down/backspace/esc/enter keys, which I know could be a sign of a keylogger... but again, I'm new, so I'm unsure.  

  [1]: http://driverscollection.com/?H=GM-M7700&By=Gigabyte