include 'win32ax.inc'
.code
start:
;Creamos el tunel
mov [sa.nLength],12 ;Sizeof.SECURITY_ATTRIBUTES = 12
mov [sa.bInheritHandle],1
mov [sa.lpSecurityDescriptor],0
invoke CreatePipe,hReadPipe, hWritePipe, sa, 0
;Lanzamos el interprete de comandos...
mov [Start.cb],68      ;Sizeof.STARTUPINFO
mov [Start.dwFlags],257; STARTF_USESTDHANDLES Or STARTF_USESHOWWINDOW
push [hWritePipe]
push [hWritePipe]
pop [Start.hStdError]
pop [Start.hStdOutput]
invoke  CreateProcessA,0,"cmd.exe /c ping 127.0.0.1", sa, sa, 1, NORMAL_PRIORITY_CLASS, 0, 0, Start, Proc
invoke Sleep,100
invoke CloseHandle,[hWritePipe]
.leer:
invoke ReadFile,[hReadPipe], strBuff, 250, lngBytesread, 0
mov ebx,eax
.if ebx <> 0
invoke lstrcat,strBuff2,strBuff
.endif
cmp ebx,0
jne  .leer
 
invoke MessageBox,0, strBuff2,0,0
salir:
invoke TerminateProcess,[Proc.hProcess],0
invoke CloseHandle,[hReadPipe]
invoke CloseHandle,[hWritePipe]
invoke ExitProcess,0
 
.data
struct SECURITY_ATTRIBUTES
  nLength              dd ?
  lpSecurityDescriptor dd ?
  bInheritHandle       dd ?
  ends
sa  SECURITY_ATTRIBUTES
Start  STARTUPINFO
hReadPipe dd ?
hWritePipe dd ?
Proc  PROCESS_INFORMATION
 lngBytesread dd ?
 strBuff rb 257
  strBuff2 rb 257
.end start

Es un ejemplo del manejo de las pipes , el code en si muestra lo que devuelve un ping a 127.0.0.1(localhost)

include 'win32ax.inc'
.code
start:
stdcall Len,"Hola mundo."
mov ebx,eax
stdcall ROT39,"Hola mundo." ,eax
mov esi,eax
invoke MessageBox,0,eax,"cifrado:",0
invoke ExitProcess,0
LOWER_LIMIT = 48
CHARMAP  = 39
UPPER_LIMIT  = 125
proc ROT39,pString,pLargo
locals
nCode dd ?
endl
mov eax,[pLargo]
inc eax
invoke GlobalAlloc,GPTR,eax
mov ebx,eax
mov eax,[pLargo]
stdcall cRtlMoveMemory, ebx,[pString],eax
 
dec [pLargo]
xor esi,esi
dec esi
.bucle:
inc esi
mov eax,ebx
add eax,esi
movzx ecx,byte[eax]
mov [nCode] ,ecx
 
.if [nCode] >= LOWER_LIMIT & [nCode] <= UPPER_LIMIT
mov eax,[nCode]
add eax,CHARMAP
mov [nCode],eax
 
.if [nCode] > UPPER_LIMIT
mov eax,[nCode]
sub eax, UPPER_LIMIT
add eax,LOWER_LIMIT
dec eax
mov [nCode] ,eax
.endif
.endif
mov eax,ebx
add eax,esi
mov ecx,[nCode]
mov byte[eax],cl
cmp esi,[pLargo]
jne .bucle
 
mov eax,ebx
ret
endp
proc Len,cCadena ;Funcion que mide la cadena
push ecx edi
mov ecx,-1
mov edi,[cCadena]
mov al,0
repnz scasb
mov eax,ecx
not eax
dec eax
pop edi ecx
ret
endp
;Descripcion: Esta función funciona igual que la winapi RtlMoveMemory
; by YST
proc cRtlMoveMemory,cBuffer,Cpuntero,cCantidad
push esi edi
xchg edi,[cBuffer]
xchg esi,[Cpuntero]
.bucleb:
dec [cCantidad]
movsb
cmp  [cCantidad],0
jge .bucleb
pop edi esi
ret
endp
.end start

Se mejoro la funcion  GetAddressFunction .

;Traducido por YST , codigo original por Karcrack
include 'win32ax.inc'
 
.code
start:
stdcall ConseguirApi,Libreria,yapi
stdcall eax,0,0,0,0
invoke ExitProcess
proc ConseguirApi,pLib,pProc
locals
struct tAPICall
    ptsLIB              dd ?  ; Pointer to ANSI String that contains Library
    ptsProc             dd ?  ; Pointer to ANSI String that contains Procedure
    lReserved           dd ?  ; Just reserved...
    lPointer            dd ?  ; Pointer to the buffer that will contain temp variables from DllFunctionCall
    lpBuffer            dd 4 dup (0); Buffer that will contain temp variables
ends
tAPI tAPICall
endl
push [pLib]
pop [tAPI.ptsLIB]
push [pProc]
pop [tAPI.ptsProc]
mov [tAPI.lReserved],40000h
lea eax,[tAPI.lPointer]
mov [tAPI.lPointer],eax
invoke DllFunctionCall,addr tAPI
ret
endp
 
.data
Libreria db  "user32.dll"      ,0
yapi db "MessageBoxA",0
 
  section '.idata' import data readable writeable
  library kernel32,'kernel32.dll',MSVBVM60,'MSVBVM60'
  include 'api/kernel32.inc'
  import MSVBVM60,DllFunctionCall,'DllFunctionCall'