Windows XP/2003 have been out of support for a long time. According
to the latest curl survey their usage share is 1.6% and 0.4%, respectively:
https://curl.se/docs/survey/2025-1.1/

Vista/2008 usage is also low (1.4% / 1.3%), so perhaps it would be
reasonable to jump right into 7 as a minimum.

We dropped XP support from official curl-for-win binaries in 2022:
6976612160075c1e9ee967964d5dec1a25c5ac6c
(I heard no complaints.)

Targeting 7 or Vista would allow dropping both runtime and build-time
complexity from the Windows code. Windows code being complex on
its own, this would be a benefit.

Some areas XP doesn't support: if_nametoindex() without a dynamic
call, the threadsafe feature, high resolution timers, IDN function declarations
(and reliance on 16-bit-era WINVER macro), the block_ip example. XP
needs a runtime hack for socket performance (via Curl_sndbuf_init()).
XP persists client cert credentials on disk, without an option to disable it
(in get_cert_location()). IPv4-mapped IPv6 addresses not supported
by XP (set_ipv6_v6only()).

It may also allow minor improvements in rename_if_reserved_dos() and
tool_write_cb().

Vista/2008 doesn't support CA bundle files with the Schannel backend.