which windows API called when execute this command
wmic qfe get hotfixid
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\Windows\CurrentVersion\Component Based servicing\Packages. WMI has its own datastores which are probably less useful to you.
When you execute command
wmic qfe get hotfixid from commandline it first execute windows API function
CreateProcessW with parameters of command and fill path of