Making public so other people can save the time I wasted. It may apply to other similar boards/PCs with 2011-ish era AMI BIOS as well.
Both guides here need a dump of BIOS ROM.
Same as this guide: https://gist.github.com/en4rab/550880c099b5194fbbf3039e3c8ab6fd
The decrypted data is the raw password as UTF-16-LE, no need to decode scancodes.
The one I got from an ES4 dump is hwdS/42LM95U.
In UEFITool, look for IdeSecurityPwnv entry in NVRAM. Copy up to 32 non-null bytes starting from either offset 0x6 or 0x26.
Decrypt with XOR key H?p1mA*k920_84o3d^!z@L.x4$kY64 (as hex 48 3F 70 31 6D 41 2A 6B 39 32 30 5F 38 34 6F 33 64 5E 21 7A 40 4C 2E 78 34 24 6B 59 36 34). You can then use HDAT2 or hdparm on Linux to unlock the drive.
The one I got for a GBTek GS1 is gMk49u7]8YGwsx3a.