private Set<Function> getThunksTo(Function function) throws CancelledException {

		Set<Function> thunksToFunction = new HashSet<Function>();
		if (function == null) {
			return thunksToFunction;
		}

		Reference[] referencesTo = api.getReferencesTo(function.getEntryPoint());

		if (referencesTo == null || referencesTo.length == 0) {
			return thunksToFunction;
		}

		for (Reference ref : referencesTo) {
			monitor.checkCancelled();
			Address address = ref.getFromAddress();

			Instruction instruction = program.getListing().getInstructionAt(address);
			if (instruction == null) {
				continue;
			}

			Function thunkFunction = api.getFunctionContaining(address);
			if (thunkFunction == null) {
				continue;
			}

			boolean isThunk = false;
			if (instruction.getFlowType() == RefType.UNCONDITIONAL_JUMP &&
				thunkFunction.isThunk()) {
				isThunk = true;
			}
			if (!isThunk) {
				FlowOverride flowOverride = instruction.getFlowOverride();
				if (flowOverride.equals(FlowOverride.CALL) ||
					flowOverride.equals(FlowOverride.CALL_RETURN)) {

					// skip any that call more than one function to limit to only possible
					// thunks
					if (thunkFunction.getCalledFunctions(monitor).size() > 1) {
						continue;
					}
					isThunk = true;
				}
			}

			if (isThunk) {
				thunksToFunction.add(thunkFunction);

				// add thunks to this function too
				Set<Function> thunksToThunk = getThunksTo(thunkFunction);
				if (thunksToThunk.isEmpty()) {
					continue;
				}

				for (Function thunk : thunksToThunk) {
					monitor.checkCancelled();

					thunksToFunction.add(thunk);
				}

			}
		}
		return thunksToFunction;
	}
Find operator_new functions (including thunks) by name or by using calls to various 
named "new" or "malloc" functions
@return a Set of operator_new functions
@throws CancelledException if cancelled
Ghidra/Features/Decompiler/ghidra_scripts/classrecovery/RecoveredClassHelper.java