On a standalone NT setup, yes the passwords are stored as hashes in the SAM database which does reside in the registry. Although you can only access that by directly accessing the disk or tricking the system into running an app under the 'system account'. It is well hidden from users normally.
'How do large programs store/change/verify without any hacker/attacker being able to read them?'
Now there's the $1million question. What you're asking is for us to explain the entire field of IT security. The field is practically a dedicated branch of computer science and maths all to itself. In fact we have Security.SE specifically for security questions.
For example if you take a simple password form on a website.
First, you have to establish a secure channel for the password to be sent from the user to the server. In order to secure that channel you require a key but... how do you secure that key. Well, some clever mathematicians designed a system on the basis that it takes a long time to factor relative prime numbers and we have 'public key cryptography.'
Once the password is sent over the secure channel it has to be stored and obviously you'd want to protect that just in case someone broke in and got your list of passwords so we have 'hashes' which are a distilled fingerprint of a larger value. But hashes are repeatable and aren't in themselves intended to be secure so over time we got to a situation where you could work all the possible answers in advance. So now we add 'salt' (extra data) into the value that we're hashing, this means that if someone replaces or steals the hash they have to work out what is hash and what is salt... When we want to check the password, we recreate the hash from the password the user provided over the secure link and our salt see if the hashes match.
It's way more complicated than that though should you decide to try to go down that rabbit hole.