The wrong lengths are sent and expected from the current code:

• Use strlen() not sizeof() to determine string length. sizeof() returns the size of the arrays (MAX_PATH), so the garbage is from the rest of the array.
• If you check the value in chars_read, you’ll see that ReadConsole is also returning the carriage return and linefeed (\r\n).
• strncmp() should be used as the return from ReadConsole isn’t null-terminated. This code works:

#include <Windows.h>
#include <stdio.h>

void PasswordCheck() {
    char message_console[MAX_PATH];
    char key_accepted[MAX_PATH];
    char bad_key[MAX_PATH];
    char password_store[MAX_PATH];
    DWORD chars_read;

    strcpy(message_console, "Enter password for this malware: ");
    WriteConsoleA(GetStdHandle(STD_OUTPUT_HANDLE), message_console, strlen(message_console), NULL, NULL);
    ReadConsoleA(GetStdHandle(STD_INPUT_HANDLE), password_store, MAX_PATH, &chars_read, NULL);
    if (!strncmp(password_store, "password\r\n",chars_read)) {
        strcpy(key_accepted, "Key Accepted");
        WriteConsoleA(GetStdHandle(STD_OUTPUT_HANDLE), key_accepted, strlen(key_accepted), NULL, NULL);
    } else {
        strcpy(bad_key, "Bad key");
        WriteConsoleA(GetStdHandle(STD_OUTPUT_HANDLE), bad_key, strlen(bad_key), NULL, NULL);
    }
}

int main(int argc, char* argv[]) {
    PasswordCheck();
    return 0;
}

C:\>test
Enter password for this malware: password
Key Accepted
C:\>test
Enter password for this malware: blah
Bad key