It depends on the implementation. Even so, it's always easier for the authors to patch the malware than it is for researchers to reverse it.