The esp pointer wasn't removed from the map after the function was called and the original return address was retrieved.
If the same function was called again with the same esp this would fail due to there already being an (old) return address associated with the esp.
The custom return value was lost when calling the original function.
Save and restore our own return value, if we're about to call the original function.
