diff --git a/nursery/encrypt-data-using-rc4-via-systemfunction032.yml b/nursery/encrypt-data-using-rc4-via-systemfunction032.yml
index 075bbbc2..de987f86 100644
--- a/nursery/encrypt-data-using-rc4-via-systemfunction032.yml
+++ b/nursery/encrypt-data-using-rc4-via-systemfunction032.yml
@@ -19,7 +19,8 @@ rule:
     - or:
       - api: SystemFunction032
       - and:
+        - match: link function at runtime on Windows
+        - string: "SystemFunction032"
         - or:
           - string: /advapi32/i
           - string: /cryptsp/i
-        - string: "SystemFunction032"