Log exit messages more intuitively.

In the case where the application crashed and NSSM then cleaned up its
child processes the events logged were confusing.  First we'd log that
we were going to kill the process tree with exit code X then we'd log
that the service had ended with exit code X.

Logging that the application exited before doing the process tree kill
makes it clearer that the cleanup is in response to the application
exit.

service.cpp

@@ -453,8 +453,18 @@ void CALLBACK end_service(void *arg, unsigned char why) {
 
   /* Check exit code */
   unsigned long exitcode = 0;
+  char code[16];
   GetExitCodeProcess(process_handle, &exitcode);
 
+  /*
+    Log that the service ended BEFORE logging about killing the process
+    tree.  See below for the possible values of the why argument.
+  */
+  if (! why) {
+    _snprintf(code, sizeof(code), "%d", exitcode);
+    log_event(EVENTLOG_INFORMATION_TYPE, NSSM_EVENT_ENDED_SERVICE, exe, service_name, code, 0);
+  }
+
   /* Clean up. */
   kill_process_tree(service_name, pid, exitcode, pid);
 
@@ -466,10 +476,6 @@ void CALLBACK end_service(void *arg, unsigned char why) {
   */
   if (why) return;
 
-  char code[16];
-  _snprintf(code, sizeof(code), "%d", exitcode);
-  log_event(EVENTLOG_INFORMATION_TYPE, NSSM_EVENT_ENDED_SERVICE, exe, service_name, code, 0);
-
   /* What action should we take? */
   int action = NSSM_EXIT_RESTART;
   unsigned char action_string[ACTION_LEN];