In TIA Portal, create an unspecified CPU,
Browse for accessible nodes, find the PLC you wish to upload from, open its blocks folder, select and copy the program blocks and then paste into the block folder of the unspecified CPU.
At least I think thats the sequence, there is no "Upload" button.