And I have found the root cause.
After profilling the application with Dependency Walker when it works normally and when it fails I found that it takes one of symantec libraries instead of standard windows dll when fails:
Loaded "c:\programdata\symantec\symantec endpoint protection\12.1.2100.2093.105\data\definitions\bashdefs\20130924.011\UMENGX86.DLL" at address 0x71610000. Successfully hooked module.
When it works normally it is not taking this library at all (so that's why it works after uninstalling Symantec Enpoint Protection completelly).
then diff gives me several instances of symantec library instead of calling internal system functions:
DllMain(0x71610000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\programdata\symantec\symantec endpoint protection\12.1.2100.2093.105\data\definitions\bashdefs\20130924.011\UMENGX86.DLL" called.
GetProcAddress(0x768C0000 [c:\windows\syswow64\KERNEL32.DLL], "FlsAlloc") called from "c:\programdata\symantec\symantec endpoint protection\12.1.2100.2093.105\data\definitions\bashdefs\20130924.011\UMENGX86.DLL" at address 0x716194D6 and returned 0x768D4F13.
GetProcAddress(0x768C0000 [c:\windows\syswow64\KERNEL32.DLL], "FlsGetValue") called from "c:\programdata\symantec\symantec endpoint protection\12.1.2100.2093.105\data\definitions\bashdefs\20130924.011\UMENGX86.DLL" at address 0x716194E3 and returned 0x768D1252.
GetProcAddress(0x768C0000 [c:\windows\syswow64\KERNEL32.DLL], "FlsSetValue") called from "c:\programdata\symantec\symantec endpoint protection\12.1.2100.2093.105\data\definitions\bashdefs\20130924.011\UMENGX86.DLL" at address 0x716194F0 and returned 0x768D41F0.
GetProcAddress(0x768C0000 [c:\windows\syswow64\KERNEL32.DLL], "FlsFree") called from "c:\programdata\symantec\symantec endpoint protection\12.1.2100.2093.105\data\definitions\bashdefs\20130924.011\UMENGX86.DLL" at address 0x716194FD and returned 0x768D357F.
DllMain(0x71610000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\programdata\symantec\symantec endpoint protection\12.1.2100.2093.105\data\definitions\bashdefs\20130924.011\UMENGX86.DLL" returned 1 (0x1).
for "normal process":
DllMain(0x71D50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\syswow64\VERSION.DLL" called.
DllMain(0x71D50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\syswow64\VERSION.DLL" returned 1 (0x1).
DllMain(0x747B0000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.DLL" called.
GetProcAddress(0x76AC0000 [c:\windows\syswow64\KERNEL32.DLL], "FlsAlloc") called from "c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.DLL" at address 0x747B3001 and returned 0x76AD4F13.
GetProcAddress(0x76AC0000 [c:\windows\syswow64\KERNEL32.DLL], "FlsGetValue") called from "c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.DLL" at address 0x747B300E and returned 0x76AD1252.
GetProcAddress(0x76AC0000 [c:\windows\syswow64\KERNEL32.DLL], "FlsSetValue") called from "c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.DLL" at address 0x747B301B and returned 0x76AD41F0.
I want to highlight that on one of our application servers is still working fine, so the logs are from there (not all the windows updates weer applied there). So looks like windows updates together with latest symantec updates, which came on 24-Sep-2013 (library is in that folder) are making som strange things.