Why I can't call calc.exe but calc is ok in assembler x64 win32 API

Question

I am currently studying shellcode writing. I have studied some assembly in the past but I jump from topic to topic in my studies and things are easily forgotten.

(the setup)

gcc --version
gcc.exe (Rev3, Built by MSYS2 project) 13.2.0
nasm --version
NASM version 2.16.01 compiled on Mar 20 2023

#build commands
nasm -fwin64 -o file.obj file.asm
gcc -o file.exe file.obj

(the problem) I wrote a program that calls WinExec with the 'calc.exe' parameter. However, the calculator app is not spawning. However, when I run the same assembly program with just 'push calc' string the calculator starts. Why the difference? Does it have to do with LSB in some way? When I push ca and lc separately it does not work either.

I am attaching the code below but I have tried many variants. Most of them run fine but do not spawn calculator. One example segfaults.

; define arch
bits 64
; make pic adresses
default rel

segment .data

segment .text
global main
extern ExitProcess
extern WinExec

extern printf

main:
    push    rbp
    mov     rbp,rsp
    sub     rsp, 32

    push    0
    push    0x636C6163
    
    ; variant code that also adds '.exe'
    ;mov     dword [rsp + 4], 0x6578652e

    mov     rcx, rsp
    mov     rdx, 1
    call    WinExec

    xor     rax,rax
    call    ExitProcess

A similar question was fixed with adding .exe with mov as in my examples that don't work. Can't use a string who is bigger than 4 bytes

Calculator should spawn but it does so only on calc string pushed as dword with nothing more.

I tried the following (attaching stack dump after prepping for each example):

1. Pushing calc on the stack and adding .exe to it with mov instruction. (executable runs and exits ok but no calculator is spawned)

-exec x/16xg $rsp
0x5ffe70:   0x6578652e636c6163  0x0000000000000000
-exec x/16xb $rsp
0x5ffe70:   0x63    0x61    0x6c    0x63    0x2e    0x65    0x78    0x65
-exec x/16s $rsp
0x5ffe70:   "calc.exe"

2. Pushing and adding so the string in the end was C:\Windows\System32\calc.exe (this causes segfault in KernelBase.dll)

-exec x/32xg $rsp
0x5ffe58:   0x6f646e69575c3a43  0x65747379535c7377
0x5ffe68:   0x636c61635c32336d  0x000000006578652e
-exec x/32xb $rsp
0x5ffe58:   0x43    0x3a    0x5c    0x57    0x69    0x6e    0x64    0x6f
0x5ffe60:   0x77    0x73    0x5c    0x53    0x79    0x73    0x74    0x65
0x5ffe68:   0x6d    0x33    0x32    0x5c    0x63    0x61    0x6c    0x63
0x5ffe70:   0x2e    0x65    0x78    0x65    0x00    0x00    0x00    0x00
-exec x/8s $rsp
0x5ffe58:   "C:\\Windows\\System32\\calc.exe"

3. Pushing ca lc .e xe in word chunks (executable runs and exits ok but no calculator is spawned)

-exec x/16xg $rsp
0x5ffe70:   0x6578652e636c6163  0x0000000000000000
-exec x/8xb $rsp
0x5ffe70:   0x63    0x61    0x6c    0x63    0x2e    0x65    0x78    0x65
-exec x/8sb $rsp
0x5ffe70:   "calc.exe"

4. Pushing ca lc in word chunks (this causes segfault in KernelBase.dll)

-exec x/8xg $rsp
0x5ffe74:   0x00000000636c6163  0x0000000000000000
-exec x/8bx $rsp
0x5ffe74:   0x63    0x61    0x6c    0x63    0x00    0x00    0x00    0x00
-exec x/8s $rsp
0x5ffe74:   "calc"

5. Pushing calc as dword (this is the only one that works)

-exec x/8xg $rsp
0x5ffe70:   0x00000000636c6163  0x0000000000000000
-exec x/8xb $rsp
0x5ffe70:   0x63    0x61    0x6c    0x63    0x00    0x00    0x00    0x00
-exec x/8sb $rsp
0x5ffe70:   "calc"