AppScan Source uses the powerful IBM research technology called F4F (Framework For Frameworks) which in practice is a bunch of *.jar files that create WAFL files.
If you have access to a box with of AppScan Source, find these files.
And drop them into a Java Decompiler like this 'JAD based' from O2 (used on the screenshot below)
And take a look at the com.ibm.appscan.frameworks.aspdotnet.jar file:
For example here is the function that seems to be doing all the heavy lifting:
References on F4F and WAFL:
- ASP.NET Support in SAST and IBM F4F (in this blog)
- From IBM Online Docs:
- https://lists.sourceforge.net/lists/listinfo/wala-wala and https://groups.google.com/forum/#!forum/wala-sourceforge-net
- Research papers: