I was actually looking at this earlier. Free Float FTP server is just a single exe (no bundled dlls). In looking at it, it doesn't have any jmp esp, call esp, "push esp, ret" or "jmp [esp+xx]"s we can use internally - so, at least on the surface of it, I don't think we can get control without using an OS module.