#ifndef _NTIOAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
NtQueryEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length,
    _In_ BOOLEAN ReturnSingleEntry,
    _In_reads_bytes_opt_(EaListLength) PVOID EaList,
    _In_ ULONG EaListLength,
    _In_opt_ PULONG EaIndex,
    _In_ BOOLEAN RestartScan
    );

#endif
View code on GitHub

#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwQueryEaFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock,
    _Out_writes_bytes_(Length) PVOID Buffer,
    _In_ ULONG Length,
    _In_ BOOLEAN ReturnSingleEntry,
    _In_reads_bytes_opt_(EaListLength) PVOID EaList,
    _In_ ULONG EaListLength,
    _In_opt_ PULONG EaIndex,
    _In_ BOOLEAN RestartScan
    );

#endif
View code on GitHub

This function is documented in Windows Driver Kit.

NtQueryEaFile is used to read EA from NTFS file. For more information about EA see FILE_FULL_EA_INFORMATION.

FileHandle

HANDLE to File Object opened with FILE_READ_EA access.

IoStatusBlock

IO result of call.

Buffer

Caller's allocated buffer for output data. See FILE_FULL_EA_INFORMATION for detailed description of fields available in buffer.

Length

Length of buffer, in bytes.

ReturnSingleEntry

If set, only one entry is returned.

EaList

Optional list of FILE_GET_EA_INFORMATION structures containing names of EA.

EaListLength

Length of EaList, in bytes.

EaIndex

Pointer to ULONG value contains 1-based index of queried attribute.

RestartScan

If set, result is the first queried EA.

Documented by

Tomasz Nowak

NtQueryEaFile - NtDoc