So, i am trying to inject some meaningful code into this application, basicly i want to write some stuff to a file and then have the program carry on on its business.
So i wrote a little something that appended to a file in C and stole the code with olly.
So far so good.
Now I try to recreate this code in my cave, again with olly(this goes into a loader at a later point) and right there im at a loss again.

This is what i am stealing from.
8B3D A4204000 MOV EDI,DWORD PTR DS:[<&MSVCR90.fwrite>]

A little call to fwrite, should not be a problem right?
Now it seems once injected;
FF15 AC204000 is just that ; CALL DWORD PTR DS:[4020AC]

We're not resolving the correct MSVCR90.fwrite address anymore .. I guess i could have told my self that these things must be dynamic in nature!
So really, my question is, what do I do from here?
Do i find the 'new' address of fwrite(if at all imported by the code i want to patch)
Do i write-to-file in another manner? (old dos way perhaps, int 21)

This is my stuff, feel free to critque;

705077AA MOV ECX,DWORD PTR SS:[ESP+4] ; recreation of code molested by jmp overwrite
705077AE PUSH ESI ; recreation of code molested by jmp overwrite
705077AF JMP 70501BA3 ; tmp patch, nopping when i want to active rest of code.
705077B4 PUSH EAX ; saving state
705077B5 PUSH EBX
705077B6 PUSH ECX
705077B7 PUSH EDX
705077B8 PUSH ESP
705077B9 PUSH EBP
705077BA PUSH EDI
705077BB NOP
705077BC PUSH 403FE8
705077C1 PUSH 403FC8 ; ASCII "c:\file.txt"
705077C6 CALL DWORD PTR DS:[4020AC] ; FIRST ERROR ADDRESS IS NOT REACHABLE.
705077CC MOV ESI,EAX
705077CE MOV EAX,ECX
705077D0 NOP
705077D1 NOP
705077D2 ADD ESP,10
705077D5 LEA EDX,DWORD PTR DS:[EAX+2]
705077D8 MOV CX,WORD PTR DS:[EAX]
705077DB ADD EAX,2
705077DE TEST CX,CX
705077E1 JNZ SHORT 705077D8
705077E3 MOV EDI,DWORD PTR DS:[<&ole32.OleUniniti>; ole32.OleUninitialize
705077E9 SUB EAX,EDX
705077EB PUSH ESI
705077EC SAR EAX,1
705077EE PUSH EAX ; <&ole32.OleUninitialize>
705077EF LEA ECX,DWORD PTR SS:[ESP+10]
705077F3 PUSH 2
705077F5 PUSH ECX
705077F6 CALL EDI
705077F8 PUSH ESI
705077F9 PUSH 2
705077FB PUSH 1
705077FD PUSH 40211C
70507802 CALL EDI
70507804 PUSH ESI
70507805 CALL DWORD PTR DS:[4020A0] ; another fcked function call
7050780B NOP
70507812 NOP
70507813 POP EDI ; right amount of pops not determined yet
70507814 POP EBP
70507815 POP ESP
70507816 POP EDX
70507817 POP ECX
70507818 POP EBX
70507819 POP EAX
7050781A NOP
7050782E NOP
7050782F JMP 70501BA3 ; JMP back from cave