Very interesting code sample in the Internet Explorer source code. This is to check if NT Service pack 3 is installed.

void CheckForSP3RSAOverwrite( void )
{
    // check for them having installed NTSP3 over the top of IE4, it nukes
    // the RSABASE reg stuff, so we have to re-do it. (our default platform is NT + SP3, but this
    // problem doesn't occur on NT5, so ignore it.
 
    OSVERSIONINFO osVer;
 
    ZeroMemory(&osVer, sizeof(osVer));
    osVer.dwOSVersionInfoSize = sizeof(osVer);
 
    if( GetVersionEx(&osVer) && (osVer.dwPlatformId == VER_PLATFORM_WIN32_NT) 
        && (osVer.dwMajorVersion == 4))
    {
        // now check to see we are on SP3 ...
        DWORD dwValue = 0;
        DWORD dwSize = sizeof( dwValue );
 
        if ( ERROR_SUCCESS == SHGetValue( HKEY_LOCAL_MACHINE, CSD_REG_PATH, CSD_REG_VALUE, NULL,
             &dwValue, &dwSize) && LOWORD( dwValue ) == 0x300 )
        {
            BYTE rgbSig[136];
            dwSize = sizeof(rgbSig);
 
            if (ERROR_SUCCESS == SHGetValue ( HKEY_LOCAL_MACHINE, RSA_PATH_TO_KEY, TEXT("Signature"), NULL,
                rgbSig, &dwSize))
            {
                if ((dwSize == sizeof(SP3Sig)) && 
                    (0 == memcmp(SP3Sig, rgbSig, sizeof(SP3Sig))))
                {
                    // need to do a DLLRegisterServer on RSABase
                    HINSTANCE hInst = LoadLibrary(TEXT("rsabase.dll"));
                    if ( hInst )
                    {
                        FARPROC pfnDllReg = GetProcAddress( hInst, "DllRegisterServer");
                        if ( pfnDllReg )
                        {
                            __try
                            {
                                pfnDllReg();
                            }
                            __except( EXCEPTION_EXECUTE_HANDLER)
                            {
                            }
                            __endexcept
                        }
 
                        FreeLibrary( hInst );
                    }
                }
            }
        }           
    }
}
#else
#define CheckForSP3RSAOverwrite() 
#endif

#ifndef UNIX
    if (!GetModuleHandle(TEXT("IEXPLORE.EXE")))
    {
        // For side by side install auto dection, if IExplore.exe is renamed, assume this is a side by side do dah
        // and we want to run in "evaluation" mode.
        fInproc = TRUE;
        fEval   = TRUE;        
    }
#endif
 
 
    // Should we run browser in a new process?
    if (fInproc || SHRegGetBoolUSValue(c_szBrowseNewProcessReg, c_szBrowseNewProcess, FALSE, FALSE))
    {
        goto InThisProcess;
    }
 
#ifdef UNIX
    if (!(fRemote && ConnectRemoteIE(lpszCmdLine, hinst)))
#endif

DWORD CClockCtl::_RecalcCurTime()
{
    SYSTEMTIME st;
 
    //
    // Current time.
    //
    GetLocalTime(&st);
 
    //
    // Don't recalc the text if the time hasn't changed yet.
    //
    if ((st.wMinute != _wLastMinute) || (st.wHour != _wLastHour) || !*_szCurTime)
    {
        _wLastMinute = st.wMinute;
        _wLastHour = st.wHour;
 
        //
        // Text for the current time.
        //
        _cchCurTime = GetTimeFormat(LOCALE_USER_DEFAULT, TIME_NOSECONDS,
            &st, _szTimeFmt, _szCurTime, ARRAYSIZE(_szCurTime));
 
        BOOL fRTL = IS_WINDOW_RTL_MIRRORED(_hwnd);
        _cchCurDate = GetDateFormat(LOCALE_USER_DEFAULT, fRTL ? DATE_RTLREADING : 0,
            &st, _szDateFmt, _szCurDate, ARRAYSIZE(_szCurDate));
 
        _cchCurDay = GetDateFormat(LOCALE_USER_DEFAULT, fRTL ? DATE_RTLREADING : 0,
            &st, TEXT("dddd"), _szCurDay, ARRAYSIZE(_szCurDay));
 
        // Don't count the NULL terminator.
        if (_cchCurTime > 0)
            _cchCurTime--;
 
        if (_cchCurDate > 0)
            _cchCurDate--;
 
        if (_cchCurDay > 0)
            _cchCurDay--;
        //
        // Update our window text so accessibility apps can see.  Since we
        // don't have a caption USER won't try to paint us or anything, it
        // will just set the text and fire an event if any accessibility
        // clients are listening...
        //
        SetWindowText(_hwnd, _szCurTime);
    }
 
    //
    // Return number of milliseconds till we need to be called again.
    //
    return 1000UL * (60 - st.wSecond);
}

/*---------------------------------------------------------------------------
 |   WINVER.C - Windows Version program
 |
 |   History:
 |  03/08/89 Toddla     Created
 |
 *--------------------------------------------------------------------------*/
 
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
 
 
#include <windows.h>
#include <port1632.h>
#include <stdio.h>
#include "winverp.h"
#include <shellapi.h>
 
void FileTimeToDateTimeString(
    LPFILETIME pft,
    LPTSTR     pszBuf,
    UINT       cchBuf)
{
    SYSTEMTIME st;
    int cch;
 
    FileTimeToLocalFileTime(pft, pft);
    FileTimeToSystemTime(pft, &st);
 
    cch = GetDateFormat(LOCALE_USER_DEFAULT, DATE_SHORTDATE, &st, NULL, pszBuf, cchBuf);
    cchBuf -= cch;
    pszBuf += cch - 1;
 
    *pszBuf++ = TEXT(' ');
    *pszBuf = 0;          // (in case GetTimeFormat doesn't add anything)
    cchBuf--;
 
    GetTimeFormat(LOCALE_USER_DEFAULT, TIME_NOSECONDS, &st, NULL, pszBuf, cchBuf);
}
 
/*----------------------------------------------------------------------------*\
|   WinMain( hInst, hPrev, lpszCmdLine, cmdShow )                              |
|                                                                              |
|   Description:                                                               |
|       The main procedure for the App.  After initializing, it just goes      |
|       into a message-processing loop until it gets a WM_QUIT message         |
|       (meaning the app was closed).                                          |
|                                                                              |
|   Arguments:                                                                 |
|   hInst       instance handle of this instance of the app                    |
|   hPrev       instance handle of previous instance, NULL if first            |
|       lpszCmdLine     ->null-terminated command line                         |
|       cmdShow         specifies how the window is initially displayed        |
|                                                                              |
|   Returns:                                                                   |
|       The exit code as specified in the WM_QUIT message.                     |
|                                                                              |
\*----------------------------------------------------------------------------*/
INT
__cdecl
ModuleEntry()
{
    TCHAR szTitle[32];
    LARGE_INTEGER Time = USER_SHARED_DATA->SystemExpirationDate;
 
    LoadString(GetModuleHandle(NULL), IDS_APPTITLE, szTitle, 32);
 
    if (Time.QuadPart) {
        TCHAR szExtra[128];
        TCHAR szTime[128];
 
        FileTimeToDateTimeString((PFILETIME)&Time, szTime, 128);
 
        LoadString(GetModuleHandle(NULL), IDS_EVALUATION, szExtra, 128);
 
        lstrcat(szExtra, szTime);
 
        ShellAbout(NULL, szTitle, szExtra, NULL);
    } else {
        ShellAbout(NULL, szTitle, NULL, NULL);
    }
 
    return 0;
}