_VWIN32_QueueUserApc

Queues a call to the specified ring 3 code in the specified thread and returns. The thread must have been placed in an alertable wait state by using one of the following Win32 functions: SleepEx, WaitForMultipleObjectsEx, or WaitForSingleObjectEx. (To make an alertable wait state, set the fAlertable parameter in these Win32 functions to TRUE.) This service may be called at event time, but not at interrupt time. Uses EAX, ECX, EDX, and Flags.

pfnRing3APC
Flat offset of ring 3 asynchronous procedure. If 0, the thread is only awakened.
dwParam
DWORD parameter to pass to APC.
ptcb
Ring 0 thread handle. If -1, use kernel service thread.