It’s more than likely they “borrowed” some other Chinese company’s cloned Windows drive and used it for their install rather than roll their own. Could be they were malicious but coming out and claiming it was an error so quickly doesn’t really push that narrative hard.
I’m thinking the code is obfuscated by random calls to various functions so that the code block isn’t just one section you can easily see but sprinkled throughout instead.