I reversed it back when it was version 1.1.something, it was basically all compiled Python modules with custom encrypted code objects and non-standard opcode mappings for the bytecode.

Quite interesting to see how it worked, and useful to get the key for the encrypted logs, to see it what it actually did while running. Back then you could intercept the https connections as well as they hadn't pinned the certificates yet, to get an even fuller picture.

There was nothing obviously nefarious going on back then, but that was quite a few years ago of course.

So what you're saying is that, if I wanted to launch a nefarious file-stealing Dropbox-like application, I should first launch the non-nefarious version, and then when it gets up to 3.6 or so, turn evil?

Yes. That's exactly the right time to turn evil.

https://xkcd.com/792/

I used gdb to talk the Dropbox client into opening a repl.

For examples see pyrasite, code.interact, etc.

If you specifically want to know what files Dropbox reads there are easy ways to observe this, like strace.