IDA common locations to put breakpoints

I'm learning that if you're looking for somewhere to breakpoint in confusing malware try

jmp eax ;   // or any register for that matter, it's jumping to a dynamic address
call eax ;   // or any register for that matter, it's jumping to a dynamic address
call dword_xxx;   // it's jumping to an address saved in data, perhaps dynamically loaded

Also a breakpoint in
ntdll.dll -> ResumeThread ; // malware may suspend and then restart when completed editing
ntdll.dll -> ResumeProcess ; // malware may suspend and then restart when completed editing

Also look at the IDA color coded graph across the top, look for a large chunk of data, which is probably the packed code, find the label for it, for xrefs to that label, then breakpoint there.