Great. It works for me now!
I added /async-upload.php to line 592. It blocks access to the custom login url, but it created some issues with the media manager. So, don’t try this one.
So, still don’t know what to do with /wp-admin/async-upload.php from revealing the custom login url.