How do malware builders work?

AFAIK, most malware builders modify some type of information within a pre built stub to change their configuration. One way I have found is through Resources. One can modify and get Resources using simple WinAPI functions. What are the other ways?

builders change configuration found functions information malware resources simple winapi work