For aes with a 128-bit block length and a 128-bit key length, what is the output of the first round of aes if the plaintext consists of 128 zeros and the first subkey consists of 128 zeros?