I fixed the routine.
I changed "add r0, r0, r4" to "mov r0, r4". It was supposed to be the second thing (it loads some code from the original function that we overwrote when we branched) but for some reason, I copied the original code wrong.
Also, I fixed another bug. Turns out, I checked for...