Here’s a quick IDA Pro script for identifying functions referenced as data (think: injected as shellcode): https://gist.github.com/williballenthin/1c2bc539041ee3bea7a4c7129072a9ac