Bus pirate interface with with winbond chip
According to the datasheet, the 3 security registers' address range are:

Security Register 1 (256 Bytes): 0x001000 ~ 0x0010FE

Security Register 2 (256 Bytes): 0x002000 ~ 0x0020FE 

Security Register 3 (256 Bytes): 0x003000 ~ 0x0030FE  

So, read 256 bytes from one register (read entire register) with Pirate bus SPI command, should be like

read Security Register 1 ==> [0x48 0x00 0x10 0x00 0x00 r r:255 ]