Ghidra: Search Program Text... (to find XOR decoding functions in malware)

In Ghidra's Search menu there is Program Text... It allows you to run an opcode search by providing the mnemonic. The search can then be further narrowed by applying a regex to the results.