Printf在FASM中崩溃

Question

以下代码打印30967和崩溃。

它是Windows 7 x86（32位）上的FASM。

有人可以向我解释为什么它会崩溃吗？

format PE console
entry start
include 'win32a.inc'
pos00:
db 10,0,0,0
str2:
db '%d',0
h:
dd -11
aa:
dd 0
start:
goto00:
        invoke GetStdHandle, [h]
        invoke gotoxy,eax,[pos00]
        push dword [aa]
        push str2
        call [printf]
        inc dword [aa]
        jmp start
data import
     library kernel32, 'kernel32.dll', \
             msvcrt, 'msvcrt.dll'
     import kernel32, \
            exit,'ExitProcess',\
            gotoxy, 'SetConsoleCursorPosition',\
            GetStdHandle,'GetStdHandle'
     import msvcrt,\
            printf,'printf'
end data

Answer 1

固定：

format PE console
entry start
include 'win32a.inc'
pos00:
db 10,0,0,0
str2:
db '%d',0
h:
dd -11
aa:
dd 0
start:
goto00:
        invoke GetStdHandle, [h]
        invoke gotoxy,eax,[pos00]
        push dword [aa]
        push str2
        call [printf]
        add esp, 8
        inc dword [aa]
        jmp start
data import
     library kernel32, 'kernel32.dll', \
             msvcrt, 'msvcrt.dll'
     import kernel32, \
            exit,'ExitProcess',\
            gotoxy, 'SetConsoleCursorPosition',\
            GetStdHandle,'GetStdHandle'
     import msvcrt,\
            printf,'printf'
end data