private Address getFirstFuncWithVar(Function func, Varnode vn) {
		Address variableAddr = vn.getAddress();
		if (variableAddr == null) {
			return Address.NO_ADDRESS;
		}

		// Note: this handles some cases where functions consist of non-contiguous blocks,
		// but since we start at the entry point we might miss things if part of the body of
		// the function is before the entry point (in address order)
		ReferenceIterator refIter =
			func.getProgram().getReferenceManager().getReferenceIterator(func.getEntryPoint());

		Address maxAddr = func.getBody().getMaxAddress();

		// return the first call to a function which takes vn as an argument
		for (Reference ref : CollectionUtils.asIterable(refIter)) {
			// check whether we are at an address not in the function
			// only necessary in case func consists of non-contiguous blocks
			// TODO: handle tail-call elimination
			if (!func.getBody().contains(ref.getFromAddress())) {
				continue;
			}
			if (isValidCallReference(ref)) {
				Function calledFunc =
					currentProgram.getFunctionManager().getFunctionAt(ref.getToAddress());
				Parameter[] params = calledFunc.getParameters();
				for (Parameter param : params) {
					Address addr = param.getMinAddress();
					if (addr != null && addr.equals(variableAddr)) {
						return ref.getToAddress();
					}
				}
			}
			// The references are sorted by their "from" addresses, so if this condition is true, 
			// we've searched all the references from the body of func and haven't found anything.
			// So, stop looking.
			if (ref.getFromAddress().compareTo(maxAddr) > 0) {
				return Address.NO_ADDRESS;
			}
		}
		//in case there are no references with "from" addresses after the body of func
		return Address.NO_ADDRESS;
	}
Returns the target of the first (in address order) call in the body of {@code func}
which takes {@code vn} as a parameter.
@param func {@link Function} whose body to search for calls
@param vn {@link Varnode} representing required parameter
@return entry point of first function called by {@code func} which uses {@code vn}
as a parameter, or {@code Address.NO_ADDRESS} if no such function found.
Ghidra/Features/Decompiler/ghidra_scripts/FindPotentialDecompilerProblems.java