First, many lawyers will be willing to enter into fee arrangements e.g. based on success or with deferred payments. It is worth getting the right lawyer as slightly greater expensive short term may save you a ton more money long term.
Second, preparing a cease and desist letter should not be too timely and therefore costly (particularly if you do the background of getting details of the breaching party and provide clear evidence of the breach etc). It will not require you to take further action if they ignore it (the letter should be sent without prejudice to your rights) but you should consider that if you don't follow-through, they may be emboldened.
Good luck!
If it is desktop software then I'd target the host and try to get it taken down. This might require a lawyer to write up a letter, or you can likely use the DMCA if the host is physically located in the US. If they're located abroad and hosted abroad, this all becomes tricky (since you'll be subject to their local laws, not yours).
I would immediately look at technical solutions to make it more expensive to steal future versions. You cannot make it impossible to steal, all you can do is make it hard enough to not be worth the small profits they'll make off of illegally selling it (these businesses operate on-mass, they don't make a ton each piece of software).
You can also target their payment processor. Just click "buy" until you go to a third party's website and then report the fraud.
If it is literally your bits (not a clone), a DMCA request to the host is easier.