You can use look ahead to check all conditions, and then match 5 to 15 characters (any), making sure there is nothing else (^ and $):
^(?=(?:.*[A-Z]){2})(?=(?:.*[a-z]){2})(?=.*\d).{5,15}$
^: start of string
(?= ): positive look ahead. Does not grab any characters, but just looks ahead to see if the pattern would be matched
(?: ): make this group non-capturing, i.e. you'll not get it as capturing group that you can reference with $1 or \1 (language dependent)
.*[A-Z]: 0 or more character(s) followed by a capital letter
.*[a-z]: 0 or more character(s) followed by a lower case letter
.*\d: 0 or more character(s) followed by a digit
{2}: previous pattern must match twice
.{5-15}: 5 to 15 characters.
$: end of string
In JavaScript you can test a string against a regular expression with test, for example:
var regex = /^(?=(?:.*[A-Z]){2})(?=(?:.*[a-z]){2})(?=.*\d).{5,15}$/;
console.log(regex.test('a9B1c')); // false, missing capital letter
console.log(regex.test('a9B1cD')); // true