Malicious software will often use the Windows API (Application Program Interface) to perform it's activities. In some cases malware will monitor and hook these function, there are many ways to do this:
- IAT (Import Address Table)
- EAT (Export Address Table)
- Guard Pages
Hooking a function allows the program to analyse and/or modify the function parameters or return result. This can be used to hide from antivirus solutions, load more malicious code into other processes etc...
Inline hooking is often achieved by overwriting the first few bytes of the function with a jump to malicious code.
IAT and EAT hooks are modifications to the PE (Portable Executable) header which redirect called functions to the malicious code.
Guard Pages can be used to hook functions as the malware can set guard pages on the first bytes of a function and handle the exception when the memory is executed.
Infecting / Embedding code in executables requires in-depth knowledge of the PE format. Using the Windows API a program can read and write to files on disk. The basic steps a program would need to follow to infect an executable:
Open the executable file with read and write access
Create a new section in the executable and write the shellcode into the file
Modify the PE Entry Point to point to the virtual address of the new section
If you are interested in the PE format, I suggest this link - http://www.openrce.org/reference_library/files/reference/PE%20Format.pdf