Cracking hash of the type md5(substr(md5($pass)).$salt)

[epixoip]

I have a program I wrote a while back that can get you half way there:

https://github.com/epixoip/md5substr

This will handle the substr(md5(pass)) part. You would just need to wrap it in md5 + salt.