Indeed. If you start Emacs on OSX and run `symbols Emacs`, you get a lot of info:

  100139190 (    0x90) verror [FUNC, EXT...
  100139220 (   0x210) Fcommandp [FUNC, ...
  100139430 (    0xf0) Fautoload [FUNC, ...
  100139520 (    0x90) un_autoload [FUNC...
  1001395b0 (    0x80) Feval [FUNC, EXT,...
  100139630 (    0x50) record_in_backtra...
  100139680 (   0x1d0) apply_lambda [FUN...
  100139850 (   0x390) Fapply [FUNC, EXT...
  100139be0 (   0x5c0) Ffuncall [FUNC, E...
  10013a1a0 (    0x90) Frun_hooks [FUNC,...
  10013a230 (   0x1d0) run_hook_with_arg...
  10013a400 (    0x20) funcall_nil [FUNC...
  10013a420 (    0x20) Frun_hook_with_ar...
  10013a440 (    0x20) Frun_hook_with_ar...
  10013a460 (    0x30) Frun_hook_with_ar...
  10013a490 (    0x30) funcall_not [FUNC...

So why not strip these? Well, you can't. But the reason is interesting. Most programs run by using shared libraries, and these libraries need to provide a standard API that other programs can use. Hence the function names. Which of course is exactly the info that a hypothetical bad guy needs to make sense of the program.

But it goes beyond this. You could imagine statically linking a program against all of its dependencies, then stripping all possible symbols. The thing is, there is plenty of info in the binary to make sense of the program. Strings, for example. Error messages. Every piece of data you want to show to the user is an indication of what the surrounding function is doing.

IDA Pro is pretty incredible in that situation. Each time you figure out what a function is doing, you just give it whatever name you want. IDA updates the whole interface so that it uses that name everywhere, instead of the hex address. You end up with a neat, perfectly sensible program. Entire game engines have been meticulously reverse engineered this way.

However, viruses use a crafty technique to prevent analysis. You encrypt your program like an onion. Your outer program runs, and everyone can see that. But it's carrying around a blob of functionality that was encrypted using the target's information. E.g. their MAC address, or a subset of their list of installed programs, or anything that would uniquely identify your target separately from everyone else. Any time the virus is installed anywhere, it tries to decrypt itself using this information, which only succeeds when it's installed on the target machine.

This defeats all attempts at analysis. You can't analyze what you can't decrypt.