Executable images and DLLs are memory-mapped when they are used, which makes it impossible to update core system files after Windows finishes booting. The MoveFileEx Windows API has an option to delay a file move until the next boot.
Any Service Pack or hot fix that update in-use, memory-mapped files install replacement files into a temporary location on the computer, and use MoveFileEx to replace files that are otherwise in use. MoveFileEx simply records commands in the PendingFileRenameOperations and PendingFileRenameOperations2 values under the registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager.
These registry entries are a REG_MULTI_SZ data type, which specifies each operation in pairs of file names: the first file name is the source location, and the second is the target location. Delete operations use an empty string as their target path.
The PendingFileRenameOperations key stores the names of files that the operating system will rename when it restarts. The key consists of pairs of file names. The operating system renames the file in the first item of the pair to match the second item of the pair.
Windows adds this entry to the registry when a user or program tries to rename a file that is in use. The file names are stored in the value of this entry until you restart the computer and the operating system renames the files.