The calling convention mismatch that is explained in the comments sounds like a good guess to me because CDECL and STDCALL have different ideas on who cleans up the stack. The value of 'i' will be pushed to the stack before the call, but both conveyor_belt (because it is STDCALL) and the caller (because it thinks conveyor_belt is CDECL) will pop the call arguments, and eventually you'll pop something into i that is larger than len.