which windows API called when execute this command
wmic qfe get hotfixid
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\Windows\CurrentVersion\Component Based servicing\Packages. WMI has its own datastores which are probably less useful to you.