I can only test this in A2K5 so it may not apply to all versions. You can run the ARX command and get a list of all modules and their commands:
Command: ARX
Enter an option [?/Load/Unload/Commands/Options]: c
Commands Registered by Extension Programs:
Command Group '*DOC(0x01185a50)'
acad-pop-dbmod, acad-pop-dbmod
acad-push-dbmod, acad-push-dbmod
ACAD_COLORDLG, ACAD_COLORDLG
... blabla.. etc...
Command Group 'ACAD_GEOM'
ALIGN, ALIGN
MIRROR3D, MIRROR3D
ROTATE3D, ROTATE3D
^There it is. I only know one way to get from the command group to the name of the ARX and that goes through the registry. Others will know better, I'm sure.
But you can get lucky by running the ARX command again, get a list of loaded ARX's (the ?-option) and associate the names with the command group. In this case, it's the geom3d.arx.
In fact, I just went into HKEY_LOCAL_MACHINE\SOFTWARE\Autodesk\AutoCAD\R16.1\ACAD-301:409\Applications\AcadGeom and checked the commands. It fit nicely.
To get a first notion of where such a command is defined, you can try check it as a symbol:
Command: !C:ROTATE3D
#<SUBR @05b5244c <EXRXSUBR>>
The EXRXSUBR type will tell you it's an ARX-defined command. Unloading the geom3d.arx and doing the above will return nil. Running the command as (C:ROTATE3D) on the command line while it is unloaded will result in an error. Depending on your demand load settings, running ROTATE3D will reload it (try unload geom3d.arx, set DEMANDLOAD to 0 and run the command. No luck. Set DEMANDLOAD to 3 and run the command. Success).