1. Execute both files.2. HauntedImage.exe no result, HauntedCursor.exe creates a "result.jpg" file. But this is not a real picture.3. Open the HauntedCursor.exe in IDA.4. See that there is a check if any parameter is passed to the executable.5. Pass the "result.jpg" as a parameter.6. Get the new file, but this file is a valid PNG.7. Open that new picture.8. See the URL Click me!. 9. Download the file.10. If I change the cursor to the downloaded one and run HauntedCursor.exe, nothing changes.11. Open HauntedCursor.exe in IDA.12. See that it is required to start MSPaint.13. Start MSPaint.14. Execute HauntedCursor.exe again.15. See the inscription that to continue it is required to press Enter.16. Press Enter.17. Now the program says that "Use the ouija board".18. Let's try to pass the downloaded cursor to HauntedImage.exe.19. As a result we get the image of that mysterious board.20. Continue to explore the HauntedCursor.exe file.21. Find the function _Z15checkSecondStepi it contains another function named _Z11movePointeri.22. That _Z11movePointeri function contains the validation of color of pixels (0, 0), (0, 1) and that we passed number 645 as a parameter.23. Also that function contains the block of moving cursor by the coordinates.24. We can either change the color of the provided pixels and pass the number 645 as a parameter to the program, or manually get the results of the coordinates, open our image of the mystery board in Paint and following the coordinates get the required letters.
Flag: VishwaCTF{p0lt3rg3i5tp0int3r}.