After installing this game, I looked trough the game folder and found two files: steam_api.dll and steam_api.ini, that obviously comes from the cracked version of the game (see attached picture). Its not just some fault in my copy .
I know GOG used cracks in some games before and I can understand that, if original developers are no longer available or the source code is long lost, but this is new and still patched game. I feel kinda cheated...

Do you seriously think GOG uses the two files without Steam's permission? Perhaps you ought to inform Steam?
Or why do you feel cheated? The game doesn't create any link to any Steam adress, folder or whatever (please read the ini file).

No, this is not a crack by GOG, it's the original content added by the developers to counter the most popular crack.

I can tell you that I bought the game directly from their site and my files also contain Steam files. I believe those files are there for Steam users. These files have no relevance to all other users.

The files are vestigial. I've seen this in a number of GOG games, and it's basically just the developers not bothering to remove the now-unnecessary Steam files. They don't actually do anything if you aren't running Steam, and having differences in the file listings of the GOG and Steam releases only adds additional wrinkles to the process of publishing updates so it's really not worth their time and effort to remove the files.

Did you looked at the attached file? Does this look like a legitimate file from developer?

### ÜÛÛÛÛÛ Ü
### °ÛÛÛÛ ßÛÛ Û² ßßßÛÛÛÛÛÛÛÜ ßßßßßÛÛ²ÛÛÜ Ü²ÛÛÛß
### ±ÛÛÛß ±ÛÛß ßßÛÛÛÛ° ßÛÛÛ ±ÛÛÛß
### ²ÛÛÛ ß ÛÛ² ßÛÛÛ± °ÛÛ²ÛÛÛ
### ²ÛÛÛ ÜÛÛÛÛÛÜ ÛÛÛ ßÛÛÛ ÜÛÛÛÛÛÛÜ ±ÛÛÛÛÛ
### ÛÛÛ° °ÛÛÛÛß ßÛ² ÛÛÛ ÛÛÛ²ÛÛ² °ÛÛ ÛÛÛ²ÛÛÛ
### ±ÛÛÛ ÛÛÛÛ° ÛÛ ÛÛÛ °ÛÛÛÛÛÛÛÛÛÛÛß ÛÛÛ± ±ÛÛÛ
### °ÛÛÛÜ ÜÛÛß²ÛÛÜ ÜÛÛ ²ÛÛ ÛÛÛ±ÛÛÛ° ÜÛÛÛ° °ÛÛÛÜ
### ßÛÛÛÛÛß ßÛÛÛ²ß ÛÛß °ÛÛÛ° ßÛÛÛÛÛÛÛ²Ûß ß²ÛÛÜ
### ÜÛÛÛÛÛÛ±
### ßßßÛÛ²ÜÜÜÜÜÛ²ÛÛÛ² ;ßß
###
###
### Game saves are stored here:
###
### %SystemDrive%\Users\%USERNAME%\AppData\Roaming\Steam\CODEX\418250\remote
###
### Achievements are stored here:
###
### %SystemDrive%\Users\%USERNAME%\AppData\Roaming\Steam\CODEX\418250\achievements.ini
###
### Stats are stored here:
###
### %SystemDrive%\Users\%USERNAME%\AppData\Roaming\Steam\CODEX\418250\stats.ini

[Settings]
###
### Game identifier (http://store.steampowered.com/app/418250)
###
?ppId=418250
###
### Steam Account ID, set it to 0 to get a random Account ID
###
#?ccountId=0
###
### Name of the current player
###
UserName=CODEX
###
### Language that will be used in the game
###
Language=english
###
### 2-digit country code
###
#Country=UK
###
### Enable lobby mode
###
LobbyEnabled=1
###
### Lobby port to listen on
###
#LobbyPort=31183
###
### Set Steam connection to offline mode
###
Offline=0
###

[Interfaces]
###
### Steam Client API interface versions
###
SteamAppList=STEAMAPPLIST_INTERFACE_VERSION001
SteamApps=STEAMAPPS_INTERFACE_VERSION007
SteamClient=SteamClient017
SteamContentServer=0
SteamController=SteamController003
SteamFriends=SteamFriends015
SteamGameServer=SteamGameServer012
SteamGameServerStats=SteamGameServerStats001
SteamHTMLSurface=STEAMHTMLSURFACE_INTERFACE_VERSION_003
SteamHTTP=STEAMHTTP_INTERFACE_VERSION002
SteamInventory=STEAMINVENTORY_INTERFACE_V001
SteamMasterServerUpdater=0
SteamMatchMaking=SteamMatchMaking009
SteamMatchMakingServers=SteamMatchMakingServers002
SteamMusic=STEAMMUSIC_INTERFACE_VERSION001
SteamMusicRemote=STEAMMUSICREMOTE_INTERFACE_VERSION001
SteamNetworking=SteamNetworking005
SteamRemoteStorage=STEAMREMOTESTORAGE_INTERFACE_VERSION013
SteamScreenshots=STEAMSCREENSHOTS_INTERFACE_VERSION002
SteamUGC=STEAMUGC_INTERFACE_VERSION007
SteamUnifiedMessages=STEAMUNIFIEDMESSAGES_INTERFACE_VERSION001
SteamUser=SteamUser018
SteamUserStats=STEAMUSERSTATS_INTERFACE_VERSION011
SteamUtils=SteamUtils007
SteamVideo=STEAMVIDEO_INTERFACE_V001
###

[DLC]
###
### Automatically unlock all DLCs
###
DLCUnlockall=0
###
### Identifiers for DLCs
###
#ID=Name
###

[AchievementIcons]
###
### Bitmap Icons for Achievements
###
#Internal Achievement Identifier Achieved=Path to Achieved Bitmap
#Internal Achievement Identifier Unachieved=Path to Unachieved Bitmap
#Unachieved=Path to General Unachieved Bitmap
###

[HTTP]
###
### Locally cached HTTP requested files
###
#MD5 Hash of URL=Path to File
###

[Avatar]
###
### Bitmap Avatar files
###
### 32x32 Pixel
#Small=Path of Avatar32.bmp relative to this .ini
###
### 64x64 Pixel
#Medium=Path of Avatar64.bmp relative to this .ini
###
### 184x184 Pixel
#Large=Path of Avatar184.bmp relative to this .ini
###

[Crack]
2a0b5907f3d58467=b7d5bc716512b5d6
2bc6e96b31c63203=b7d5bc716512b5d6
5ed0875f2691e8bc=b7d5bc716512b5d6
d87e51d607af0194=b7d5bc716512b5d6
f098457bcc263a8d=b7d5bc716512b5d6

*Takes a closer look, does some googling*

The only thing unusual about it is the ascii-art logo of a warez group in the header. It's otherwise looks like a perfectly normal config file of some sort. What probably happened is that the original game's release used the Steamworks API (which comes with DRM built in), some crackers cracked it, and when it came time to do the DRM-free release the developers simply used that crack rather than removing the DRM themselves. It's a perfectly acceptable solution for creating a DRM-free release, and if it weren't for the signature of a warez group right there in the files no one would have ever known.

Let me remove the comment lines: Nothing really exciting - except the [Crack] section, where 5 placeholders are set to the same value (thats at least how I read it, I'm not an expert). Somehow the program must be able to deal with the section and its entries. Technically it is possible that the otherwise built in DRM is disabled in this way (if true, then others must be able to use this exploit, too).
But what I really find hard to believe that GOG uses a crack without the developers' / publishers approval and consent. These guys would have taken GOG to court immediately. I think its fair to assume that GOG sells the game based on a contractual agreement with whoever has the right to sign such a contract with GOG.
So what's the point of this discussion?

PS: If someone is really curious what the [Crack] section does: A way to test it might be to remove it (make it a comment by adding hashes), or to change one or several of the values and then run the program. If the section disables DRM, then any modifications are likely to re-enable it.
I myself won't test it.

Once again, this is done intentionally.

The most often used crack - CODEX relies on this file. Thus the game contains the slightly modified version of this file to easily check if the CODEX crack is used.

Interesting - thanks for mentioning this aspect.

Well the User name is set to CODEX, - thats a WAREZ Group

en.wikipedia.org/wiki/List_of_warez_groups

if i can up this topic to say we (developer) use crack when we want to test the release game that use steam api and launch steam, the game won't open if we don't crack it.