Presumably he has whatever software (could be an .exe, could be multiple, could be a bunch of DLLs... probably a collection of binaries), and then ran that through a disassembler, and this is the output.

My guess: he doesn't, but it's been said that it's a standard feature of the software. If that's the case, then it most likely had that logic in there, just as a "feature" rather than something that looks blatantly malicious.