Printf crashes in FASM

Question

The following code prints 30967 and crashes.

It is FASM on Windows 7 x86 (32bit).

Could someone please explain to me why it crashes?

format PE console
entry start
include 'win32a.inc'
pos00:
db 10,0,0,0
str2:
db '%d',0
h:
dd -11
aa:
dd 0
start:
goto00:
        invoke GetStdHandle, [h]
        invoke gotoxy,eax,[pos00]
        push dword [aa]
        push str2
        call [printf]
        inc dword [aa]
        jmp start
data import
     library kernel32, 'kernel32.dll', \
             msvcrt, 'msvcrt.dll'
     import kernel32, \
            exit,'ExitProcess',\
            gotoxy, 'SetConsoleCursorPosition',\
            GetStdHandle,'GetStdHandle'
     import msvcrt,\
            printf,'printf'
end data

Answer 1

Fixed:

format PE console
entry start
include 'win32a.inc'
pos00:
db 10,0,0,0
str2:
db '%d',0
h:
dd -11
aa:
dd 0
start:
goto00:
        invoke GetStdHandle, [h]
        invoke gotoxy,eax,[pos00]
        push dword [aa]
        push str2
        call [printf]
        add esp, 8
        inc dword [aa]
        jmp start
data import
     library kernel32, 'kernel32.dll', \
             msvcrt, 'msvcrt.dll'
     import kernel32, \
            exit,'ExitProcess',\
            gotoxy, 'SetConsoleCursorPosition',\
            GetStdHandle,'GetStdHandle'
     import msvcrt,\
            printf,'printf'
end data