https://bugs.winehq.org/show_bug.cgi?id=49116
--- Comment #2 from Zebediah Figura z.figura12@gmail.com --- A bit of research later, I understand this better.
BootstrapperApplicationFactory is irrelevant, because what CreateInstance() returns is System.ObjectHandle. The 0x38 offset is Unwrap(). The missing methods are those of System.Object itself.
The CCW comes from System.Runtime.InteropServices.Marshal:GetCCW, which is an icall to mono/metadata/cominterop.c. That code seems to want to do the right thing, but it doesn't for some reason. It'll take some more debugging to figure out why.