If there was a plan to steal the plane, could the carefully planned "hijack route" meant to confuse/avoid radar/etc have been pre-entered into the computer as route 2, so that at the appropriate time, all that would be needed to execute would be to press a couple buttons?
As far as I can see, yes. I'm guessing that the FO loads the FMS at Malaysian, and the captain checks it. With some carriers the PNF loads and the PF checks. In all honesty I don't think I've ever checked the secondary flight plan on preflight. Maybe I'll start.
Also, some of the folks I fly with seem to spend more time out of the seat than in it once airborne, don't know about this crew. One of the pilots could have programmed the second route after takeoff without the other's knowledge. In the Egyptair 990 crash the FO waited for the captain to go to the lav, then he started chanting and pulling circuit breakers.
Since the waypoints on the turnback route were well behind the KUL-PEK route, they would not appear as clues on the nav display screens in front of the pilots.