The ABI consists of different parts which can (with some probability) be decoded from the raw EVM bytecode:

• Extract/Decode the 4-byte function selector (e.g. evMole, Heimdall, WhatsABI, ...)
• Lookup the function selector in a database to find a human-readable name (e.g. https://docs.openchain.xyz/)
• Extract/Decode the input parameter types (e.g. evMole, Heimdall, ...)
• Extract/Decode the return parameter types

Related question:
Get/guess unverified contract's external methods