Function NtQueryEaFile 

pub unsafe extern "system" fn NtQueryEaFile(
    filehandle: HANDLE,
    iostatusblock: *mut IO_STATUS_BLOCK,
    buffer: *mut c_void,
    length: u32,
    returnsingleentry: bool,
    ealist: *const c_void,
    ealistlength: u32,
    eaindex: *const u32,
    restartscan: bool,
) -> NTSTATUS