I would like to provide a short answer, please see Lindell's tutorial for a comprehensive explanation.
As with the semi-honest model, the simulator in the malicious model also needs to simulate the real-world protocol execution (where some parties are controlled by an adversary). The simulator has access to the ideal functionality and an adversary (which is assumed to exist when constructing the simulator). The simulator can treat the adversary as a black-box algorithm and control its inputs and randomness tape. So, the simulator can rewind the adversary back to a particular step (where it needs some input to continue) and then feed it with a different input. However, simulation in the malicious model is much harder than that in the semi-honest model, mainly because we do not know what inputs the adversary is actually using even if we know what inputs are given to them.