I am not going to post any links here, but a good place to find their narrative starting propagate is on far-right social networks. In some cases, there will be complete silence, like an event never happened. In others, all you need to do is track the accounts of foreign "reporters" or talking heads that still have access to those platforms.
And yeah, the teenaged edgelords will pick up the slack shortly after. It takes about a day or so for the conspiracy theories to propagate.
This particular incident is probably going to spawn "wHaT aBoUt dOnbASs?" type trolling, if I had to guess.
Apps are huge and compilers optimize the fuck out of the code. Code optimization doesn't always make sense so you need to have a detailed understanding of which compilers were used. There could be hundreds of libraries involved or even layers of obfuscation in some cases. Loops can be unwrapped, or other bits of code optimized for specific architectures. Some of the logic won't appear logical.
Disassemblers can do a decent job converting code back to C/C++, but even then, you have to go through the code line by line converting function names and variable names back to something that can be referenced later as a meaningful name.
You aren't wrong: All the code is there. It's just a matter of putting all the human readable references back into anything you disassembled.
Waaaay back in the day, we could tear apps apart easily if they were small. There were only a few flavors of assembly and compilers were still fairly basic for what they were. Regardless, it wasn't a small task.
I played around with cracking for a while just to learn about it and honestly, it was kinda easy before everything was offloaded to "the cloud". It's just a matter of tracing execution and finding a few critical comparisons or jumps to alter. Even then, it could take me a day or two just to walk through what was basically one or two functions.