diff --git a/src/core/hle/Intercept.cpp b/src/core/hle/Intercept.cpp
index 846994a03..7e1cdfe65 100644
--- a/src/core/hle/Intercept.cpp
+++ b/src/core/hle/Intercept.cpp
@@ -192,10 +192,7 @@ void CDECL EmuOutputMessage(xb_output_message mFlag,
         }
         case XB_OUTPUT_MESSAGE_DEBUG:
         default: {
-#ifdef _DEBUG_TRACE
-            printf("%s\n", message);
-#endif
-
+            EmuLog(LOG_LEVEL::DEBUG, "%s", message);
             break;
         }
     }
@@ -390,7 +387,7 @@ void EmuHLEIntercept(Xbe::Header *pXbeHeader)
 	std::stringstream sstream;
 	char tAsciiTitle[40] = "Unknown";
 	std::setlocale(LC_ALL, "English");
-	std::wcstombs(tAsciiTitle, g_pCertificate->wszTitleName, sizeof(tAsciiTitle));
+	std::wcstombs(tAsciiTitle, CxbxKrnl_Xbe->m_Certificate.wszTitleName, sizeof(tAsciiTitle));
 	std::string szTitleName(tAsciiTitle);
 	CxbxKrnl_Xbe->PurgeBadChar(szTitleName);
 	sstream << cachePath << szTitleName << "-" << std::hex << uiHash << ".ini";
@@ -513,9 +510,9 @@ void EmuHLEIntercept(Xbe::Header *pXbeHeader)
 
 	// Store Certificate Details
 	symbolCacheData.SetValue(section_certificate, sect_certificate_keys.Name, tAsciiTitle);
-	symbolCacheData.SetValue(section_certificate, sect_certificate_keys.TitleID, FormatTitleId(g_pCertificate->dwTitleId).c_str());
-	symbolCacheData.SetLongValue(section_certificate, sect_certificate_keys.TitleIDHex, g_pCertificate->dwTitleId, nullptr, /*UseHex =*/true);
-	symbolCacheData.SetLongValue(section_certificate, sect_certificate_keys.Region, g_pCertificate->dwGameRegion, nullptr, /*UseHex =*/true);
+	symbolCacheData.SetValue(section_certificate, sect_certificate_keys.TitleID, FormatTitleId(CxbxKrnl_Xbe->m_Certificate.dwTitleId).c_str());
+	symbolCacheData.SetLongValue(section_certificate, sect_certificate_keys.TitleIDHex, CxbxKrnl_Xbe->m_Certificate.dwTitleId, nullptr, /*UseHex =*/true);
+	symbolCacheData.SetLongValue(section_certificate, sect_certificate_keys.Region, CxbxKrnl_Xbe->m_Certificate.dwGameRegion, nullptr, /*UseHex =*/true);
 
 	// Store Library Details
 	for (unsigned int i = 0; i < pXbeHeader->dwLibraryVersions; i++) {
diff --git a/src/core/kernel/init/CxbxKrnl.cpp b/src/core/kernel/init/CxbxKrnl.cpp
index fcc275b9b..02a3af653 100644
--- a/src/core/kernel/init/CxbxKrnl.cpp
+++ b/src/core/kernel/init/CxbxKrnl.cpp
@@ -1149,18 +1149,6 @@ void CxbxKrnlEmulate(unsigned int reserved_systems, blocks_reserved_t blocks_res
 		}
 	}
 
-	// Decode kernel thunk table address :
-	uint32_t kt = CxbxKrnl_Xbe->m_Header.dwKernelImageThunkAddr;
-	kt ^= XOR_KT_KEY[to_underlying(xbeType)];
-
-	// Process the Kernel thunk table to map Kernel function calls to their actual address :
-	MapThunkTable((uint32_t*)kt, CxbxKrnl_KernelThunkTable);
-
-	// Does this xbe import any other libraries?
-	if (CxbxKrnl_Xbe->m_Header.dwNonKernelImportDirAddr) {
-		ImportLibraries((XbeImportEntry*)CxbxKrnl_Xbe->m_Header.dwNonKernelImportDirAddr);
-	}
-
 	g_ExceptionManager = new ExceptionManager(); // If in need to add VEHs, move this line earlier. (just in case)
 
 	// Launch the XBE :
@@ -1170,7 +1158,7 @@ void CxbxKrnlEmulate(unsigned int reserved_systems, blocks_reserved_t blocks_res
 		void* XbeTlsData = (XbeTls != nullptr) ? (void*)CxbxKrnl_Xbe->m_TLS->dwDataStartAddr : nullptr;
 		// Decode Entry Point
 		xbox::addr EntryPoint = CxbxKrnl_Xbe->m_Header.dwEntryAddr;
-		EntryPoint ^= XOR_EP_KEY[to_underlying(xbeType)];
+		EntryPoint ^= XOR_EP_KEY[to_underlying(CxbxKrnl_Xbe->GetXbeType())];
 		// Launch XBE
 		CxbxKrnlInit(
 			XbeTlsData, 
@@ -1476,10 +1464,23 @@ __declspec(noreturn) void CxbxKrnlInit
 	if (BootFlags & BOOT_SKIP_ANIMATION) {} // TODO
 	if (BootFlags & BOOT_RUN_DASHBOARD) {} // TODO
 
-    CxbxInitAudio();
+	CxbxInitAudio();
 
+	// EmuHLEIntercept must be call before MapThunkTable, otherwise scanning for symbols will not work properly.
 	EmuHLEIntercept(pXbeHeader);
 
+	// Decode kernel thunk table address :
+	uint32_t kt = CxbxKrnl_Xbe->m_Header.dwKernelImageThunkAddr;
+	kt ^= XOR_KT_KEY[to_underlying(CxbxKrnl_Xbe->GetXbeType())];
+
+	// Process the Kernel thunk table to map Kernel function calls to their actual address :
+	MapThunkTable((uint32_t *)kt, CxbxKrnl_KernelThunkTable);
+
+	// Does this xbe import any other libraries?
+	if (CxbxKrnl_Xbe->m_Header.dwNonKernelImportDirAddr) {
+		ImportLibraries((XbeImportEntry *)CxbxKrnl_Xbe->m_Header.dwNonKernelImportDirAddr);
+	}
+
 	if (!bLLE_USB) {
 		SetupXboxDeviceTypes();
 	}