菜鸟问题 eip=00000000 如何解决？

程序功能：把文件一的汉语英语句子先后顺序对调后写入文件二
BUG: 第一次运行到ReadSentence 的ret处后，出现异常,eip=00000000
请教大虾怎么回事？
原始：文件一内容
汉
En
字
WW

目标：文件二内容
En
汉
WW
字


.386
.model flat, stdcall
option casemap :none

include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
include \masm32\include\comdlg32.inc

includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
includelib \masm32\lib\comdlg32.lib

exitWhenError MACRO
inc eax
jz exit
dec eax
ENDM

.data
ofn OPENFILENAME <0> ;打开文件对话框要用到该结构
szFileName db 256 dup(0)
szFilterString db '文本文件(*.txt)',0,'*.txt',0,0 ;文件过滤器字符串
szMyTitle db '汉-英句子调换行顺序，*.txt->*.zzy-2.txt', 0
szSuffix db '.zzy-2.txt'

.data?
ver db ?
flag dd ?
t1 dd ?
hfile dd ?
hfile2 dd ?
fname2 db 256 dup(?)
fsize dd ?
t2 dd ?
pos1 dd ?
pos2 dd ?
pos3 dd ?
pos4 dd ?
.code
GetFileNameFromDialog proc
mov ofn.lStructSize,sizeof ofn ;结构的大小
mov ofn.lpstrFilter,offset szFilterString ;文件过滤器
mov ofn.lpstrFile,offset szFileName ;文件名的存放位置
mov ofn.nMaxFile,256 ;文件名的最大长度
mov ofn.Flags,OFN_FILEMUSTEXIST or OFN_HIDEREADONLY or OFN_LONGNAMES
mov ofn.lpstrTitle,offset szMyTitle ;“打开”对话框的标题
invoke GetOpenFileName,addr ofn ;显示打开对话框
ret
GetFileNameFromDialog endp

ReadSentence proc ; arg1:DWORD, arg2:DWORD
mov flag, 0
mov pos1, 0
mov pos2, 0

invoke SetFilePointer, hfile, 0, 0, FILE_CURRENT
mov pos1, eax
;读取一个字符
readagain:

;是否读到结尾
invoke SetFilePointer, hfile, 0, 0, FILE_CURRENT
cmp eax, fsize
je readend

invoke ReadFile, hfile, offset ver, 1, offset t1, NULL
cmp eax, 1
jne readend

;忽略'\r','\n',' ',0~9
;isalpha:
cmp ver, 0Dh
je readagain
cmp ver, 0Ah
je readagain
cmp ver, 20h
je readagain
cmp ver, 30h
jb notspec
cmp ver, 39h
ja notspec
jmp readagain

notspec:
;判断ver是否为英文, IsDBCSLeadByte()=false 为英文
invoke IsDBCSLeadByte, ver
cmp eax, 0
je yingwen

;hanzi:
cmp flag, 1
je readagain
cmp flag, 0
jne readend
mov flag, 1
jmp readagain

yingwen:
cmp flag, 2
je readagain
cmp flag, 0
jne readend
mov flag, 2
jmp readagain

readend:
invoke SetFilePointer, hfile, -1, 0, FILE_CURRENT
mov pos2, eax
ret 0
ReadSentence endp

WriteSentence proc arg1:DWORD, arg2:DWORD
mov eax, arg1
mov ebx, arg2
cmp eax, 0
jb writeend
cmp eax, ebx
jbe writeend
invoke SetFilePointer, hfile, arg1, 0, FILE_BEGIN
mov ecx, arg2
sub ecx, arg1
writeagain:
invoke ReadFile, hfile, offset ver, 1, offset t1, NULL
invoke WriteFile, hfile2, offset ver, 1, offset t1, NULL
dec ecx
cmp ecx, 0
jne writeagain
writeend:
ret
WriteSentence endp

start:
call GetFileNameFromDialog
cmp eax, 0
je exit2

;打开文件
invoke CreateFile, offset szFileName, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL
mov hfile, eax
exitWhenError

invoke SetFilePointer, hfile, 0, 0, FILE_END
mov fsize, eax
invoke SetFilePointer, hfile, 0, 0, FILE_BEGIN

invoke lstrcpy, offset fname2, offset szFileName
invoke lstrcat, offset fname2, offset szSuffix
invoke CreateFile, offset fname2, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL
mov hfile2, eax
exitWhenError

readwrite:
invoke ReadSentence
cmp flag, 0
je exit
cmp flag, 1
je rw1
cmp flag, 2
je rw2
jmp exit

rw1:
mov eax, pos1
mov ebx, pos2
mov pos3, eax
mov pos4, ebx
jmp readwrite
rw2:
invoke WriteSentence, pos1, pos2
invoke WriteSentence, pos3, pos4
invoke SetFilePointer, hfile, pos2, 0, FILE_BEGIN
jmp readwrite

exit:
;关闭文件
invoke CloseHandle, hfile
invoke CloseHandle, hfile2

exit2:
;退出
invoke ExitProcess, 0

end start