We know the exact version of openssl they’re using, so we can just build the same version ourselves, get the address of the functions, and look for the same pattern of instructions in the Zoom binary. Not sure if LTO could break this or not though.
The easiest way if you have a capable debugger is probably to look for SSL strings/error codes in rodata and see where they're referenced.
Or IDA can even output C code that is very close to the original.
If this was 32 vs 64bit or some such you'd be pretty hosed at where everything was I imagine.
That's also mainly how malware reverse manages to "hunt" APT families, by finding meaningful little patterns in the instructions and look for code reuse in other binaries :D