Bug with winexe in cloud.py module in version 2019.2.1

Description of Issue

After upgrade from 2018.3.4 to 2019.2.1 winexe command got messed up.

Setup

Install windows server via cloud module.
my cloud profile:

nl1-win2016-backend:
  provider: nlxen
  image: windows_2016_backend_template
  clone: True
  win_installer: /srv/salt/win/files/Salt-Minion-2018.3.4-Py3-AMD64-Setup.exe
  win_username: Administrator
  win_password: '1qaz2wsX'
  minion:
    master:
      - myMaster.my.domain,com
  ipv4_cidr: 1.1.1.1/24
  ipv4_gw: 1.1.1.254
  use_winrm: False
  winrm_verify_ssl: False
  port_timeout: 30

Steps to Reproduce Issue

1. The winexe command got messed up and presented the actual password instead just "REDUCTED"
2. The command syntax also got messed up and missing "" for the sc command itself.

[INFO    ] Running command under pid 10714: 'winexe -U 'Administrator%XXX-REDACTED-XXX' //1.1.1.1 winexe -U 'Administrator%<plainTextPassword>' //1.1.1.1 sc query winexesvc query winexesvc'
[DEBUG   ] Executing command(PID 10714): 'winexe -U 'Administrator%XXX-REDACTED-XXX' //172.16.31.178 winexe -U 'Administrator%plainTextPassword' //1.1.1.1 sc query winexesvc query winexesvc'
[DEBUG   ] Return code was 1

Versions Report

Salt Version:
Salt: 2019.2.1

Dependency Versions:
cffi: 1.6.0
cherrypy: unknown
dateutil: 1.5
docker-py: Not Installed
gitdb: 0.6.4
gitpython: 1.0.1
ioflo: Not Installed
Jinja2: 2.7.2
libgit2: 0.24.6
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.4.8
mysql-python: Not Installed
pycparser: 2.14
pycrypto: 2.6.1
pycryptodome: 3.6.1
pygit2: 0.24.2
Python: 2.7.5 (default, Oct 30 2018, 23:45:53)
python-gnupg: Not Installed
PyYAML: 3.11
PyZMQ: 15.3.0
RAET: Not Installed
smmap: 0.9.0
timelib: Not Installed
Tornado: 4.2.1
ZMQ: 4.1.4

System Versions:
dist: centos 7.6.1810 Core
locale: UTF-8
machine: x86_64
release: 3.10.0-957.1.3.el7.x86_64
system: Linux
version: CentOS Linux 7.6.1810 Core

Start in the cloud.py module at the winexe command construction and logging path described by the report. Reproduce with the supplied cloud profile and inspect the generated sc query winexesvc command. Done means the command syntax is correct and the password remains redacted in all displayed command output.