FASM中的Printf崩溃

Question

下面的代码打印30967和崩溃。

它是在Windows 7 x86上的FASM (32位)。

有人能给我解释一下它为什么会坠毁吗？

format PE console
entry start
include 'win32a.inc'
pos00:
db 10,0,0,0
str2:
db '%d',0
h:
dd -11
aa:
dd 0
start:
goto00:
        invoke GetStdHandle, [h]
        invoke gotoxy,eax,[pos00]
        push dword [aa]
        push str2
        call [printf]
        inc dword [aa]
        jmp start
data import
     library kernel32, 'kernel32.dll', \
             msvcrt, 'msvcrt.dll'
     import kernel32, \
            exit,'ExitProcess',\
            gotoxy, 'SetConsoleCursorPosition',\
            GetStdHandle,'GetStdHandle'
     import msvcrt,\
            printf,'printf'
end data

Answer 1

固定：

format PE console
entry start
include 'win32a.inc'
pos00:
db 10,0,0,0
str2:
db '%d',0
h:
dd -11
aa:
dd 0
start:
goto00:
        invoke GetStdHandle, [h]
        invoke gotoxy,eax,[pos00]
        push dword [aa]
        push str2
        call [printf]
        add esp, 8
        inc dword [aa]
        jmp start
data import
     library kernel32, 'kernel32.dll', \
             msvcrt, 'msvcrt.dll'
     import kernel32, \
            exit,'ExitProcess',\
            gotoxy, 'SetConsoleCursorPosition',\
            GetStdHandle,'GetStdHandle'
     import msvcrt,\
            printf,'printf'
end data