A legitimate company should send you all the code of the site on demand. Thus leaving you free to engage another developer. However, if you do not pay for the hosting of the web site and know the password for developer access to it, you have a problem. Even if you own the copyright of your site, and even that is not certain from what you say, you may be powerless.
The answer may be to set conditions in writing for their continued involvement e.g. What functionality is required, when it is to be supplied, and the penalty for non-compliance. But even that may not achieve anything apart from giving you the legal right to stop paying them!
Also, I would question the benefit of pursuing them beyond that. I.e. If they are cowboys, how good will the code they have written be anyway? You may be better off terminating the arrangement and putting it down to experience. Next time, (if you haven't already) get the agreement in writing before you hand over any cash!