Escaping special characters in password with WinRS

We use WinRS command from various admin scripts to issues commands to remote Windows servers:

winrs /remote:host /username:user /password:pwd command

This is working well except when password pwd contains certain special characters. I can't quite pinpoint which special characters cause issues. Most of them can be escaped with ^ char (e.g. <, >, ^) and % for %. However even with these escaped, I'm still struggling to get some passwords working. For example, I can't get this password to work: A3={d6*s]bf=<F$s;fg^%3g Can someone provide a definitive list of which special characters needs to be escaped in which way?

Do note that putting the parameter in quotes (single or double) doesn't work, as the quotes are taken to be part of the password.