I suggest you start from this sample here: C++ app hosts CLR 4 and invokes .NET assembly (CppHostCLR) that seems to do almost what you need. The only missing part is it's not loading the assembly from memory, but uses a file instead.

So what you need to do is just replace the following lines (in RuntimeHostV4.cpp):

// Load the .NET assembly. 
wprintf(L"Load the assembly %s\n", pszAssemblyName); 
hr = spDefaultAppDomain->Load_2(bstrAssemblyName, &spAssembly); 
if (FAILED(hr)) 
{ 
    wprintf(L"Failed to load the assembly w/hr 0x%08lx\n", hr); 
    goto Cleanup; 
} 

by the following lines that use this method instead: _AppDomain.Load Method (Byte[])

// let's suppose I have a LPBYTE (pointer to byte array) and an ULONG (int32) value
// that describe the buffer that contains an assembly bytes.
LPBYTE buffer = <my buffer>;
ULONG size = <my buffer size>;

// let's create an OLEAUT's SAFEARRAY of BYTEs and copy the buffer into it
// TODO: add some error checking here (mostly for out of memory errors)
SAFEARRAYBOUND bounds = { size, 0 };
SAFEARRAY *psa = SafeArrayCreate(VT_UI1, 1, &bounds);
void* data;
SafeArrayAccessData(psa, &data);
CopyMemory(data, buffer, size);
SafeArrayUnaccessData(psa);

hr = spDefaultAppDomain->Load_3(psa, &spAssembly);
if (FAILED(hr))
{
    wprintf(L"Failed to load the assembly w/hr 0x%08lx\n", hr);
    goto Cleanup;
}
SafeArrayDestroy(psa); // don't forget to destroy